Message: 3 Date: Tue, 24 Jan 2012 08:23:45 +0100 From: NdK <ndk.clanbo@gmail.com> Subject: Re: LDAP Group assign to vlan after AD user authentication To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4F1E5C81.9080209@gmail.com> Content-Type: text/plain; charset=ISO-8859-1

Il 23/01/2012 14:48, Arnaud Loonstra ha scritto:

...

But I reckon you could also do something like that in post-auth section if (Ldap-Group == "cn=mygroup,ou=groups,o=radius") { update reply { Tunnel-type = VLAN Tunnel-medium-type = IEEE-802 Tunnel-Private-Group-Id = 1 } } I think it could be possible to do the same using exec, a script and wbinfo... Just still don't know how. With for T in $(wbinfo --user-domgroups `wbinfo -n <ADusername>`) ; do wbinfo -s $T; done I can get all AD groups <ADusername> is into. Checking group membership would be even easier. But how do I set Tunnel-Private-Group-Id from an exec-ed script?

BYtE, Diego.

I checked it up with modifying the ldap module and then using the users file, at least for non-roaming users. Found out also by trial and error the output of wbinfo is not consistent. Best regards, Rui Ribeiro