RE: About Monthly Time Limits
Please let me know if you can tell what I'm doing wrong. I do authorization and authentication all from LDAP. Here's my line in ldap.attrmap: replyItem Ldap-UserDn dn Here's my counter config: counter monthly { filename = ${raddbdir}/db.monthly key = Ldap-UserDn count-attribute = Acct-Session-Time reset = monthly counter-name = Monthly-Session-Time check-name = Max-Monthly-Session allowed-servicetype = Framed-User cache-size = 5000 } But I get this in my radius logs when I logout: rlm_counter: Packet Unique ID = '549154f744531b54' rlm_counter: Could not find the key-attribute in the request. Returning NOOP. I hope I'm not missing something really simple. Thanks Ben On Tue, 2006-03-14 at 00:05 +0100, Seferovic Edvin wrote:
-----Original Message----- From: freeradius-users-> bounces+edvin.seferovic=kolp.at@lists.freeradius.org [mailto:freeradius->users-bounces+edvin.seferovic=kolp.at@lists.freeradius.o rg] On Behalf Of >Ben Plimpton Sent: Montag, 13. März 2006 23:34 To: freeradius-users@lists.freeradius.org Subject: RE: About Monthly Time Limits
This is a somewhat related question.
Can I use an attribute that is not in the Stop record as the key for a monthly counter? For example, I would like to make the Ldap-UserDn attribute the key for the counter. Is there a way to make that value available to my counter?
Thanks
Sure.. if you use LDAP for Authentication and Authorisation ! there is ldap.attrmap file which maps the LDAP attributes to freeradius attributes.
The key is usually username ( or something else specific for a user or machine ).
I have such setup in a boarding home and it works like a charm ;)
Regards,
Edvin
Ben Plimpton <bplimpton@sopris.net> wrote:
Here's my line in ldap.attrmap: replyItem Ldap-UserDn dn ... rlm_counter: Could not find the key-attribute in the request. Returning NOOP.
reply != request
I hope I'm not missing something really simple.
You'll have to edit rlm_ldap to allow adding LDAP attributes as requestItems. Alan DeKok.
I am using freeradius rev 1.1.0 I have everything running great I am using AAA authorization on different Network Devices, Cisco Routers, Cisco Switches, Foundry Switches, Juniper FW's. I have setup VSA's to respond to the user to set their privilege level upon successful authentication, then the authorization portion actually sets the privilege level I need to have different privilege levels based upon which NAS they are coming from, eg... Connecting while on the Corporate Network privilege level = 8, same user Connecting thru IPass out of the office privilege level = 5. Any assistance with this would be greatly appreciated. Thank you in advance for your help Jeff Stout CCT
Jeff Stout <jstout@cctus.com> wrote:
I need to have different privilege levels based upon which NAS they are coming from, eg... Connecting while on the Corporate Network privilege level = 8, same user Connecting thru IPass out of the office privilege level = 5.
Any assistance with this would be greatly appreciated.
Key off of the Client-IP-Address, which is the IP of the NAS. You could use NAS-IP-Address or NAS-Identifier, but they are less reliable in proxy situations. Alan DeKok.
I think you can use radreply directive with your variable, if your NAS supports that. -----Original Message----- From: freeradius-users-bounces+radiussupport=lrcommunications.net@lists.freeradius .org [mailto:freeradius-users-bounces+radiussupport=lrcommunications.net@lists.fr eeradius.org] On Behalf Of Jeff Stout Sent: Thursday, March 16, 2006 11:44 AM To: FreeRadius users mailing list Subject: Different source NAS for Differnet privilege Level I am using freeradius rev 1.1.0 I have everything running great I am using AAA authorization on different Network Devices, Cisco Routers, Cisco Switches, Foundry Switches, Juniper FW's. I have setup VSA's to respond to the user to set their privilege level upon successful authentication, then the authorization portion actually sets the privilege level I need to have different privilege levels based upon which NAS they are coming from, eg... Connecting while on the Corporate Network privilege level = 8, same user Connecting thru IPass out of the office privilege level = 5. Any assistance with this would be greatly appreciated. Thank you in advance for your help Jeff Stout CCT - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Alex M -
Ben Plimpton -
Jeff Stout