Hi, I need some help to assign VLAN to users from a particular OU of Active Directory. It does not seems to work. The code below is the post-auth in the inner-tunnel. At the moment, the filter does not work as always get assigned the VLAN 40. What else should i do to get the filtering to work?. Thanks. post-auth { ldap if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "30" } } else { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "40" } } }
Well, to start, you have two commas after your OU=. I believe that is likely a typo. On Wed, Dec 7, 2016 at 9:57 PM, Albert K <alberk@gmail.com> wrote:
Hi,
I need some help to assign VLAN to users from a particular OU of Active Directory. It does not seems to work. The code below is the post-auth in the inner-tunnel. At the moment, the filter does not work as always get assigned the VLAN 40.
What else should i do to get the filtering to work?. Thanks.
post-auth {
ldap
if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") {
update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-Id = "30"
}
}
else { update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-Id = "40"
}
} } - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Hi,
Yes, that was a type when I cut and paste into notepad. The config file
setting looks ok, just that it is not recognizing the OU. Is there any
setting the ldap that I need to set ? Thanks.
On Thu, Dec 8, 2016 at 11:20 AM, Matt Brennan <brennanma@gmail.com> wrote:
> Well, to start, you have two commas after your OU=. I believe that is
> likely a typo.
>
> On Wed, Dec 7, 2016 at 9:57 PM, Albert K <alberk@gmail.com> wrote:
>
> > Hi,
> >
> >
> > I need some help to assign VLAN to users from a particular OU of Active
> > Directory. It does not seems to work. The code below is the post-auth in
> > the inner-tunnel. At the moment, the filter does not work as always get
> > assigned the VLAN 40.
> >
> > What else should i do to get the filtering to work?. Thanks.
> >
> >
> >
> >
> > post-auth {
> >
> > ldap
> >
> > if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") {
> >
> > update reply {
> >
> > Tunnel-Type = VLAN
> >
> > Tunnel-Medium-Type = IEEE-802
> >
> > Tunnel-Private-Group-Id = "30"
> >
> > }
> >
> > }
> >
> > else {
> > update reply {
> >
> > Tunnel-Type = VLAN
> >
> > Tunnel-Medium-Type = IEEE-802
> >
> > Tunnel-Private-Group-Id = "40"
> >
> > }
> >
> > }
> > }
> > -
> > List info/subscribe/unsubscribe? See http://www.freeradius.org/
> > list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html
Hi It is perfectly good and working if I filter by "Group name" in my case called "special" but I do not want to tag eveyone (quite a number of users) in the OU with another group just for wifi. So the "==" is working. if (LDAP-Group == "cn=special,dc=mycompay,dc=com") { On Thu, Dec 8, 2016 at 3:28 PM, Michael Ströder <michael@stroeder.com> wrote:
Albert K wrote:
if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") {
^^ This does not look right.
Ciao, Michael.
Albert K wrote:
It is perfectly good and working if I filter by "Group name" in my case called "special" but I do not want to tag eveyone (quite a number of users) in the OU with another group just for wifi. So the "==" is working.
I meant the two commas but the e-mail formatting misplaced the markers. Ciao, Michael.
if (LDAP-Group == "cn=special,dc=mycompay,dc=com") {
On Thu, Dec 8, 2016 at 3:28 PM, Michael Ströder <michael@stroeder.com> wrote:
Albert K wrote:
if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") {
^^ This does not look right.
Ciao, Michael.
On 08/12/2016 07:56, Albert K wrote:
It is perfectly good and working if I filter by "Group name" in my case called "special" but I do not want to tag eveyone (quite a number of users) in the OU with another group just for wifi.
It sounds like you're not talking about group membership then, but the OU component of the user's DN? In that case, perhaps what you want is a regexp match on the DN: if (&LDAP-UserDN =~ /,ou=foo,dc=example,dc=com$/i) { "$" matches end of string, and "i" means "case insensitive" HTH, Brian.
Hi, I still cannot get that to work. The radiusd seems to not be able to evaluate the statement. What else in not right here? Thanks. Wed Dec 7 05:45:12 2016 : Debug: (9) if (&LDAP-UserDN =~ /,ou=hod,dc=mycompany,dc=com$/i) { Wed Dec 7 05:45:12 2016 : ERROR: (9) Failed retrieving values required to evaluate condition Wed Dec 7 05:45:12 2016 : Debug: (9) else { Wed Dec 7 05:45:12 2016 : Debug: (9) update reply { Wed Dec 7 05:45:12 2016 : Debug: (9) &Tunnel-Type = VLAN Wed Dec 7 05:45:12 2016 : Debug: (9) &Tunnel-Medium-Type = IEEE-802 Wed Dec 7 05:45:12 2016 : Debug: (9) &Tunnel-Private-Group-Id = "40" Wed Dec 7 05:45:12 2016 : Debug: (9) } # update reply = noop Wed Dec 7 05:45:12 2016 : Debug: (9) } # else = noop LDAP Search dn: CN=AL John,OU=HOD,DC=mycompany,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: AL John sn: John givenName: AL distinguishedName: CN=AL John,OU=HOD,DC=mycompany,DC=com instanceType: 4 whenCreated: 20161114092737.0Z whenChanged: 20161208095249.0Z displayName: AL John uSNCreated: 24709 uSNChanged: 33392 name: AL John objectGUID:: a10CMWI1m0+ENVS77ibeJA== userAccountControl: 512 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 131254645351788150 lastLogoff: 0 lastLogon: 131254645443226047 pwdLastSet: 131235892579628082 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAArDo7VXRW+jTSFI1mVAQAAA== accountExpires: 9223372036854775807 logonCount: 3 sAMAccountName: ajohn sAMAccountType: 805306368 userPrincipalName: ajohn@mycompany.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=mycompany,DC=com dSCorePropagationData: 20161208095249.0Z dSCorePropagationData: 16010101000000.0Z lastLogonTimestamp: 131254582966146932 On Thu, Dec 8, 2016 at 7:07 PM, Brian Candler <b.candler@pobox.com> wrote:
On 08/12/2016 07:56, Albert K wrote:
It is perfectly good and working if I filter by "Group name" in my case called "special" but I do not want to tag eveyone (quite a number of users) in the OU with another group just for wifi.
It sounds like you're not talking about group membership then, but the OU component of the user's DN?
In that case, perhaps what you want is a regexp match on the DN:
if (&LDAP-UserDN =~ /,ou=foo,dc=example,dc=com$/i) {
"$" matches end of string, and "i" means "case insensitive"
HTH,
Brian.
On Dec 8, 2016, at 8:10 PM, Albert K <alberk@gmail.com> wrote:
Hi,
I still cannot get that to work. The radiusd seems to not be able to evaluate the statement. What else in not right here? Thanks.
Wed Dec 7 05:45:12 2016 : Debug: (9) if (&LDAP-UserDN =~ /,ou=hod,dc=mycompany,dc=com$/i) { Wed Dec 7 05:45:12 2016 : ERROR: (9) Failed retrieving values required to evaluate condition
It should be &control:LDAP-UserDN ... Alan DeKok.
Thanks Alan. That does it. Will report and ask more questions if I encounter further issues. Thank you again. On Fri, Dec 9, 2016 at 9:29 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Dec 8, 2016, at 8:10 PM, Albert K <alberk@gmail.com> wrote:
Hi,
I still cannot get that to work. The radiusd seems to not be able to evaluate the statement. What else in not right here? Thanks.
Wed Dec 7 05:45:12 2016 : Debug: (9) if (&LDAP-UserDN =~ /,ou=hod,dc=mycompany,dc=com$/i) { Wed Dec 7 05:45:12 2016 : ERROR: (9) Failed retrieving values required to evaluate condition
It should be &control:LDAP-UserDN ...
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On 09/12/2016 01:10, Albert K wrote:
I still cannot get that to work. The radiusd seems to not be able to evaluate the statement.
I can't test it right now, but briefly looking at the source I think LDAP-UserDN is put on the control list, not the request list. Try: &control:LDAP-UserDN
On 08/12/2016 02:57, Albert K wrote:
ldap
if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") {
update reply {
Apart from the problem with two commas which has already been reported: 1. LDAP-Group is a "magic" attribute, dynamically expanded when you reference it. It does not work unless you use the new "&" notation - i.e. &LDAP-Group. It will silently expand to empty if you omit "&". (That is, unless you have set "cacheable_dn = yes" in which case the group memberships are queried up-front and stored as real AV-pairs; but even then, including the "&" does not hurt and is a good idea) 2. It's multi-valued, so you need "[*]" to check if any value matches: if (&LDAP-Group[*] == "OU=hod,dc=mycompany,dc=com") { 3. I'm pretty sure that user-defined groups in Active Directory have CN as the group name, and appear under the 'Users' tree. So it would most likely look like: if (&LDAP-Group[*] == "cn=Staff,cn=Users,dc=mycompany,dc=com") { At this point you can get better information from running freeradius in debugging mode (radiusd -X or freeradiusd -X in the foreground). HTH, Brian.
Hi,
I need some help to assign VLAN to users from a particular OU of Active Directory. It does not seems to work. The code below is the post-auth in the inner-tunnel. At the moment, the filter does not work as always get assigned the VLAN 40.
What else should i do to get the filtering to work?. Thanks.
first step, look at the debug output to see what is going on, what 'LDAP-Group' value actually is etc. then, next step is use eg ldapsearch comamnd line tool to verify that the account has ONE match to your query.... alan
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Albert K -
Brian Candler -
Matt Brennan -
Michael Ströder