Hi Clayton, Please share the debug output https://wiki.freeradius.org/guide/radiusd-X <https://wiki.freeradius.org/guide/radiusd-X> --- Jorge Pereira jpereira@freeradius.org

On 8 Jul 2020, at 13:58, extern.clayton.knorr--- via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

I have a freeradius server set up to use ldap.google.com as an ldap server, and I'm using an if statement in post-auth to verify group membership.

It seems with certain accounts, and only most of the time, freeradius reports "no group membership attribute(s) found in user object" Other users never seem to have the issue. Has anybody seen this kind of flaky behavior with google's ldap servers? I can't duplicate the issue using ldapsearch. With that I get the memberof attributes every time even with the problem accounts.

Also, I'm checking for membership of one of two groups and I noticed in interactive mode that it is actually binding and looking up the user account twice, once for each group membership check. Sometimes with the flaky accounts it actually fails to see the memberof attribute once and succeeds the other time. Is there a way to make this more efficient and just do one bind? My if statement is formatted thus:

if (LDAP-Group == "group1") || (LDAP-Group == "group2") {

noop

}

else {

reject

}

Any insight would be appreciated.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html