Hey guys, I have another question. Again I haven't found nice solution yet. How can I map different LDAP attribute to the same RADIUS attribute depending on some access request parameters? E.g. in my LDAP I have: - adslVirtualRouterName - xdslVirtualRouterName - xxxVirtualName I'd like to map this LDAP attribute to RADIUS ERX-Virtual-Router-Name depending on e.g. NAS-IP-Address. One solution would be declare some additional variables in /etc/raddb/dictionary and just map it in ldap module update section. But is there better solution? thanks, Krzysztof
One solution would be declare some additional variables in /etc/raddb/dictionary and just map it in ldap module update section.
That's likely to be the most direct and straight-forward way to do it , followed by some unlang to poke the value(s) into the attribute. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Yeah I thought so. Another approach would be (specific to my configuration) to map directly in ldap module update like this: update { reply:ERX-Virtual-Router-Name := "%{control:nasType}virtualrouter" } Where control:nasType was set earlier (authorize section) based on e.g. NAS-IP-Address (NAS-IP-Address -> "xdsl" | "adsl" " ...) thanks for the reply, Krzysztof
Hello everyone, maybe a bit off-topic, but another way to this would be to define nasType in the clients.conf file and then refer to it with %{client:nasType}. So something like this client something { ipaddr = 1.2.3.4 secret = hereiam nasType = xdsl } ... update { reply:ERX-Virtual-Router-Name := "%{client:nasType}virtualrouter" } (of course this won't work if the same intermediate server proxies requests from different types of NAS) Cheers, Enrico On Wed, Jul 06, 2016 at 01:22:53PM +0200, Adamczak Krzysztof wrote:
Yeah I thought so. Another approach would be (specific to my configuration) to map directly in ldap module update like this: update { reply:ERX-Virtual-Router-Name := "%{control:nasType}virtualrouter" }
Where control:nasType was set earlier (authorize section) based on e.g. NAS-IP-Address (NAS-IP-Address -> "xdsl" | "adsl" " ...)
thanks for the reply, Krzysztof - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the tip that's one more way to tackle it. But in my case I cannot rely on client config (you gave the reason why ;) Actually I found that using original idea works best for me - I mean just declare couple variables in dictionary / map them in ldap module / add them to reply in post-auth section. It gives me more robustness because of ulang (I had to add some additional logic as well). anyway thanks again, Krzysztof
On Jul 8, 2016 6:30 AM, "Enrico Polesel" <polesel@poisson.phc.unipi.it> wrote:
Hello everyone,
maybe a bit off-topic, but another way to this would be to define nasType in the clients.conf file and then refer to it with %{client:nasType}. So something like this
client something { ipaddr = 1.2.3.4 secret = hereiam nasType = xdsl } ... update { reply:ERX-Virtual-Router-Name := "%{client:nasType}virtualrouter" }
(of course this won't work if the same intermediate server proxies requests from different types of NAS)
Cheers, Enrico
I use shortname and then Client-Shortname for exactly that. I set my BNGs with two values "A_B" in client shortname then use unlang to split the string and use them for various parts of logic. One reason is "Environment_UniqueVal" so I can determine if it's production or another environment. This way I have a single config raddb across all environments. Release management is a case of taring the directory and dropping it onto a new environment then doing a -XC to make sure it's ok and bouncing the daemon.
On Wed, Jul 06, 2016 at 01:22:53PM +0200, Adamczak Krzysztof wrote:
Yeah I thought so. Another approach would be (specific to my configuration) to map directly in ldap module update like this: update { reply:ERX-Virtual-Router-Name := "%{control:nasType}virtualrouter" }
Where control:nasType was set earlier (authorize section) based on e.g. NAS-IP-Address (NAS-IP-Address -> "xdsl" | "adsl" " ...)
thanks for the reply, Krzysztof - List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See
On Fri, Jul 08, 2016 at 08:54:06AM +1200, Peter Lambrechtsen wrote:
I use shortname and then Client-Shortname for exactly that.
I set my BNGs with two values "A_B" in client shortname then use unlang to split the string and use them for various parts of logic. One reason is "Environment_UniqueVal" so I can determine if it's production or another environment. This way I have a single config raddb across all environments. Release management is a case of taring the directory and dropping it onto a new environment then doing a -XC to make sure it's ok and bouncing the daemon.
Shortname is just one variable, with custom variables you can use as many as you want without using any '_' trick! ;) Enrico
participants (5)
-
Adamczak Krzysztof -
Alan DeKok -
Enrico Polesel -
Peter Lambrechtsen -
Stefan Paetow