assigning vlan based on LDAP attribute
Hi All, I'm trying to add a user to a vlan based on an ldap attribute. I've checked out: http://vuksan.com/linux/dot1x/802-1x-LDAP.html annd saw the following would have to be added to the user's ldap record: radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 If I don't want to actually insert that into the LDAP database, is it possible for Radius to figure out which vlan to assign to based on some other already existing LDAP attribute? For example, if I want to assign users whose userDepartment attribute equals ITS into vlan 3 and those who's userDepartment attribute equals HR into vlan 4? If so, could you give me a link to how to do that, or explain briefly? Thanks for your time, Matt mda@unb.ca
I'm trying to add a user to a vlan based on an ldap attribute. I've checked out: http://vuksan.com/linux/dot1x/802-1x-LDAP.html annd saw the following would have to be added to the user's ldap record: radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2
Yes that's usually the syntax, but it might depend on you switch/AP, so check the docs of your device.
If I don't want to actually insert that into the LDAP database, is it possible for Radius to figure out which vlan to assign to based on some other already existing LDAP attribute?
One way to do that is to use LDAP groups. If your users are in dedicated LDAP groups, then a rule like the following in your "users" file will do the trick: DEFAULT Huntgroup-Name == myAP, Ldap-Group == Engineering User-Name=`%{User-Name}`, radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 Fall-Through = no
For example, if I want to assign users whose userDepartment attribute equals ITS into vlan 3 and those who's userDepartment attribute equals HR into vlan 4? If so, could you give me a link to how to do that, or explain briefly?
Ldap-Groups can be "true ldap groups" such as groupOfNames entries. However, you may also want to map LDAP-Groups to the value of an attribute inside the user's entry. See the groupmembership_attribute in the ldap configuration section # groupmembership_attribute: The attribute in the user entry that states # the group the user belongs to. Refer to the docs/rlm_ldap for more information HTH, Thibault
One way to do that is to use LDAP groups. If your users are in dedicated LDAP groups, then a rule like the following in your "users" file will do the trick: DEFAULT Huntgroup-Name == myAP, Ldap-Group == Engineering User-Name=`%{User-Name}`, radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 Fall-Through = no
Sorry... my mistake, use the following rule instead: DEFAULT Huntgroup-Name == myAP, Ldap-Group == Engineering User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802 Tunnel-Private-Group-Id=2 Tunnel-Type=VLAN Fall-Through = no Thibault
I'm a bit confused on this one. I want my users vlan'd based on their affiliation (ie, staff, student) In my radiusd.conf file, under ldap, I've put: groupmembership_attribute = eduPersonPrimaryAffiliation Do I need to do more in my radiusd.conf file than that? I assume this means assign them to a group based on the value stored in the LDAP field eduPersonPrimaryAffiliation I then added to my users file: DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2, Tunnel-Type=VLAN, Fall-Through = no But this doesn't seem to work. My staff users do not get assigned to vlan 2. Do I need to make a huntgroup for myAP? If there's a link to an overview or something, it would be much appreciated. Any help is appreciated. Thanks Matt mda@unb.ca -----Original Message----- From: Thibault Le Meur [mailto:Thibault.LeMeur@supelec.fr] Sent: July 28, 2006 5:37 PM To: FreeRadius users mailing list; Thibault Le Meur Cc: mda@unb.ca; FreeRadius users mailing list Subject: Re: assigning vlan based on LDAP attribute
One way to do that is to use LDAP groups. If your users are in dedicated LDAP groups, then a rule like the following in your "users" file will do the trick: DEFAULT Huntgroup-Name == myAP, Ldap-Group == Engineering User-Name=`%{User-Name}`, radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 Fall-Through = no
Sorry... my mistake, use the following rule instead: DEFAULT Huntgroup-Name == myAP, Ldap-Group == Engineering User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802 Tunnel-Private-Group-Id=2 Tunnel-Type=VLAN Fall-Through = no Thibault
I'm a bit confused on this one.
I want my users vlan'd based on their affiliation (ie, staff, student) In my radiusd.conf file, under ldap, I've put:
groupmembership_attribute = eduPersonPrimaryAffiliation
That's a good start, but sending the whole ldap configuration section would help.
Do I need to do more in my radiusd.conf file than that?
I think you hould check that you do not have groupname_attribute and groupmembership_filter set.
I assume this means assign them to a group based on the value stored in the LDAP field eduPersonPrimaryAffiliation
I then added to my users file: DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2, Tunnel-Type=VLAN, Fall-Through = no
There are several things to check here: * is the NAS-IP-ADDRESS of the AccessPoint defined in the huntgroup "myAP" in your huntgroups file ? * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses other format). The best way to check this is to stop your radius server and run it manually with "radiusd -X". Then send the debug log to the list (take care passwords are written cleartext).
But this doesn't seem to work. My staff users do not get assigned to vlan 2. Do I need to make a huntgroup for myAP?
Of course... Unless you remove the "Huntgroup-Name == myAP," check item HTH, Thibault
My ldap section from radiusd.conf looks like: ldap { server = "ldapserver.net.org" identity = "uid=name,dc=net,dc=org" password = password basedn = "ou=stuffdc=net,dc=org" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_attribute = eduPersonPrimaryAffiliation timeout = 4 timelimit = 3 net_timeout = 1 } My users file contains the following at the end: DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2, Tunnel-Type=VLAN, Fall-Through = no My huntgroups file has: myAP NAS-IP-Address == x.x.x.141 In my Debug I noticed that although I have them commented out of radiusd.conf, I still see: Debug: ldap: groupname_attribute = "cn" Debug: ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" You asked: * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses other format). How do I check that? Thanks Matt -----Original Message----- From: Thibault Le Meur [mailto:Thibault.LeMeur@supelec.fr] Sent: September 27, 2006 1:36 PM To: mda@unb.ca Cc: 'FreeRadius users mailing list' Subject: RE : assigning vlan based on LDAP attribute
I'm a bit confused on this one.
I want my users vlan'd based on their affiliation (ie, staff, student) In my radiusd.conf file, under ldap, I've put:
groupmembership_attribute = eduPersonPrimaryAffiliation
That's a good start, but sending the whole ldap configuration section would help.
Do I need to do more in my radiusd.conf file than that?
I think you hould check that you do not have groupname_attribute and groupmembership_filter set.
I assume this means assign them to a group based on the value stored in the LDAP field eduPersonPrimaryAffiliation
I then added to my users file: DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2, Tunnel-Type=VLAN, Fall-Through = no
There are several things to check here: * is the NAS-IP-ADDRESS of the AccessPoint defined in the huntgroup "myAP" in your huntgroups file ? * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses other format). The best way to check this is to stop your radius server and run it manually with "radiusd -X". Then send the debug log to the list (take care passwords are written cleartext).
But this doesn't seem to work. My staff users do not get assigned to vlan 2. Do I need to make a huntgroup for myAP?
Of course... Unless you remove the "Huntgroup-Name == myAP," check item HTH, Thibault
My ldap section from radiusd.conf looks like: ldap { server = "ldapserver.net.org" identity = "uid=name,dc=net,dc=org" password = password basedn = "ou=stuffdc=net,dc=org" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_attribute = eduPersonPrimaryAffiliation timeout = 4 timelimit = 3 net_timeout = 1 }
It seems ok to me...
My users file contains the following at the end: DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2, Tunnel-Type=VLAN, Fall-Through = no
My huntgroups file has: myAP NAS-IP-Address == x.x.x.141
In my Debug I noticed that although I have them commented out of radiusd.conf, I still see: Debug: ldap: groupname_attribute = "cn" Debug: ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obje ctClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))"
Strange...
You asked: * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses other format). How do I check that?
Check in your AP documentation ? But this format is the most commonly used, so I don't think this is the issue. Can you send a more complete debug. Thibault
I think part of my problem is that I do not have the vlans defined in the Access Point. I incorrectly assumed that the AP would receive the vlan info from the Radius server, and tag all outgoing packets from the wireless client with that tag. However, I'm starting to think that that is completely incorrect?! I should probably be creating all the vlans within the AP right? If that's the case, it looks like I need a separate SSID per Vlan (using Avaya gear here). I really hope that is not the case. Thanks Matt mda@unb.ca -----Original Message----- From: Thibault Le Meur [mailto:Thibault.LeMeur@supelec.fr] Sent: September 27, 2006 2:03 PM To: mda@unb.ca Cc: 'FreeRadius users mailing list' Subject: RE : RE : assigning vlan based on LDAP attribute
My ldap section from radiusd.conf looks like: ldap { server = "ldapserver.net.org" identity = "uid=name,dc=net,dc=org" password = password basedn = "ou=stuffdc=net,dc=org" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_attribute = eduPersonPrimaryAffiliation timeout = 4 timelimit = 3 net_timeout = 1 }
It seems ok to me...
My users file contains the following at the end: DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2, Tunnel-Type=VLAN, Fall-Through = no
My huntgroups file has: myAP NAS-IP-Address == x.x.x.141
In my Debug I noticed that although I have them commented out of radiusd.conf, I still see: Debug: ldap: groupname_attribute = "cn" Debug: ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obje ctClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))"
Strange...
You asked: * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses other format). How do I check that?
Check in your AP documentation ? But this format is the most commonly used, so I don't think this is the issue. Can you send a more complete debug. Thibault
I think part of my problem is that I do not have the vlans defined in the Access Point. I incorrectly assumed that the AP would receive the vlan info from the Radius server, and tag all outgoing packets from the wireless client with that tag. However, I'm starting to think that that is completely incorrect?! I should probably be creating all the vlans within the AP right?
It really depends on your Access Point. I use a Strix access point on which you do not have to define the vlans on the AP: you only have to set the interface to trunk mode (Tagged) and the AP uses the vlan assigned by the radius server for the wireless client. => this is the most common scenario However on my Proxim AP2000, I have to define some hidden SSIDs to the several vlans that can be affected by the radius server: * the wireless client authenticates itself to the braodcasted SSID (statically assigned a wrong vlan) * the radius server replies Access-Accept and assigns the vlan tag * the AP transparently retries an authentication of the client on the hidden SSID that corresponds to this vlan As you can see everything depends on your AP features.
If that's the case, it looks like I need a separate SSID per Vlan (using Avaya gear here). I really hope that is not the case
First of all, you have to determin if the radius server is replying Access-Accept and assigning the vlan tag. See the radiusd -X log. Thibault
Hi,
You asked: * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses other format). How do I check that?
easiest way is to set up a dumb user in your users files which returns the attributes you want (check with radtest) and then run that against your AP - and check that the VLAN change works for you. THEN move to LDAP alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Matt Ashfield -
Thibault Le Meur