interpret check-Item and change reply-item to set VLAN
Hallo Liste, is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'. ldap.attrmap: checkItem Tunnel-Private-Group-Id sectionNetwork replyItem Tunnel-Private-Group-Id sectionNetwork the following in users file wont work: DEFAULT Tunnel-Private-Group-Id == "sec11" Tunnel-Private-Group-Id=111, Reply-Message += "changed " DEFAULT Auth-Type == EAP Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Reply-Message += "Access success for %{User-Name}.", Fall-Through = no I use FreeRADIUS Version 2.1.6, for host i386-pc-solaris2.8, openLDAP, 802.1x with mschapv2. This works fine for me. radiusd -X output: ... rlm_ldap: performing search in dc=domain,dc=de, with filter (uid=user) checking if remote access for user is allowed by uid looking for check items in directory... rlm_ldap: sectionNetwork -> Tunnel-Private-Group-Id:0 == "sec11" rlm_ldap: sambaNTPassword -> NT-Password == <removed> rlm_ldap: sambaLMPassword -> LM-Password == <removed> looking for reply items in directory... rlm_ldap: sectionNetwork -> Tunnel-Private-Group-Id:0 = "sec11" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ... ++[eap] returns ok } # server inner-tunnel Got tunneled reply code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Got tunneled reply RADIUS code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Tunneled authentication was successful. SUCCESS Saving tunneled attributes for later ++[eap] returns handled ... Sending Access-Accept of id 131 to 10.0.0.12 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" User-Name = "user" MS-MPPE-Recv-Key = 0x611ed2d5955bded1d3302045c5930fd4aad610a0b6f5aa1045ba0477f12b7eee MS-MPPE-Send-Key = 0xc38e1cad9590596e3902a46a40706ad8bde70f05bde110698b631b503c00f51b EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. ... thanks and beste Gruesse Michael
On 09/13/2010 01:44 PM, Michael Bathe wrote:
Hallo Liste,
is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'.
ldap.attrmap: checkItem Tunnel-Private-Group-Id sectionNetwork replyItem Tunnel-Private-Group-Id sectionNetwork
This looks wrong.
the following in users file wont work:
DEFAULT Tunnel-Private-Group-Id == "sec11" Tunnel-Private-Group-Id=111, Reply-Message += "changed "
DEFAULT Auth-Type == EAP Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Reply-Message += "Access success for %{User-Name}.", Fall-Through = no
This also looks wrong. What are you trying to do, in more detail? Something is settings Tunnel-Private-Group-Id to "sec11", and then you want to re-write it to "111" - why not just change the thing that sets it in the first place?
Michael Bathe wrote:
is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'.
$ man unlang The ldap module doesn't do generic comparison or setting of attributes. Neither does the "users" file. But the "unlang" policy language does. Alan DeKok.
Thanks for reply! I have solved my attempt to set VLAN-Group-ID based on checkItem by insert this line in post-auth section of 'sites-available/default' -- $INCLUDE ${confdir}/setTunnelGroup -- In the file setTunnelGroup I insert this: -- if (reply:SectionNetwork == "sec11") { update reply { Tunnel-Private-Group-ID :=111 } } -- In file 'dictionary' I add this line: -- ATTRIBUTE SectionNetwork 4000 string -- In file 'ldap.attrmap' I add this line: -- replyItem SectionNetwork sectionNetwork -- @ Phil: My problem is that the value of ldap-attribute is not correspond to the vlan name in our cisco switch at this time. LG Michael Am 13.09.2010 16:10, schrieb Alan DeKok:
Michael Bathe wrote:
is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'.
$ man unlang
The ldap module doesn't do generic comparison or setting of attributes. Neither does the "users" file.
But the "unlang" policy language does.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Michael Bathe Rechenzentrum -Netzwerkadministration- Tel.: +49 (0)331/288-1803 Fax: +49 (0)331/288-1730 Email: michael.bathe@gfz-potsdam.de ___________________________________ Helmholtz-Zentrum Potsdam Deutsches GeoForschungsZentrum - GFZ Stiftung des Öff. Rechts Land Brandenburg Telegrafenberg G257, D-14473 Potsdam
participants (3)
-
Alan DeKok -
Michael Bathe -
Phil Mayers