Hi, I have want to the login user to be authorized according to their user grouping in Microsoft AD and also a catch all default. At the moment I am testing with two DEFAULT. Is it possible to do a Catch all DEFAULT. My example below only catch non hod group. Any help would be much appreciated. Thank you. /users DEFAULT Ldap-Group == "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" DEFAULT Ldap-Group != "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40"
Hi,
I have want to the login user to be authorized according to their user grouping in Microsoft AD and also a catch all default. At the moment I am testing with two DEFAULT. Is it possible to do a Catch all DEFAULT. My example below only catch non hod group. Any help would be much appreciated. Thank you.
use Unlang and LDAP-Group etc eg in the post-auth phase of inner-tunnel, if doing EAP - ensuring that the attributes are copied to the outer reply....as per the docs and inline comments: pseudo code: if(LDAP-Group = "cn=hod,cn=users,dc=smartoptz,dc=com"){ update reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" } else { update reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40" } alan
Hi Alan, It tried adding this in the Post-Auth of the inner-tunnel but keep getting the following error. When I comment out the Code below then the radius (v3.0.11) will run so I am sure that there is no extra braces. including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel /usr/local/etc/raddb/sites-enabled/inner-tunnel[313]: Expecting section start brace '{' after "{ update" Errors reading or parsing /usr/local/etc/raddb/radiusd.conf ### Added Code if(LDAP-Group == "cn=hod,cn=users,dc=smartoptz,dc=com") {update reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" } } else { udpate reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40" } } On Fri, Nov 18, 2016 at 7:19 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
I have want to the login user to be authorized according to their user grouping in Microsoft AD and also a catch all default. At the moment I am testing with two DEFAULT. Is it possible to do a Catch all DEFAULT. My example below only catch non hod group. Any help would be much appreciated. Thank you.
use Unlang and LDAP-Group etc eg in the post-auth phase of inner-tunnel, if doing EAP - ensuring that the attributes are copied to the outer reply....as per the docs and inline comments:
pseudo code:
if(LDAP-Group = "cn=hod,cn=users,dc=smartoptz,dc=com"){ update reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" } else { update reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40" }
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Nov 18, 2016, at 8:16 PM, Albert K <alberk@gmail.com> wrote:
It tried adding this in the Post-Auth of the inner-tunnel but keep getting the following error.
Read "man unlang". And Alan's example again. The unlang parser isn't smart. You can't just randomly add braces and reformat things. Follow existing examples. It really does help.
### Added Code if(LDAP-Group == "cn=hod,cn=users,dc=smartoptz,dc=com") {update reply
Why the heck are you putting the { on a new line, smashed up against the "update" text? Don't do that.
{ Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" } } else { udpate reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40" } }
This is all formatted badly. Don't do that. if (LDAP-Group == "cn=hod,cn=users,dc=smartoptz,dc=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "30" } } else { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "40" } } That will work. Alan DeKok.
Hi Alan, Thank you for pointing out my mistake. Starting the curly bracket on a new line is a old habit of mine, just helps me to visually aligning up all the closing bracket. Did not know it was a big problem with the parser. Thank you again. On Sat, Nov 19, 2016 at 9:54 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 18, 2016, at 8:16 PM, Albert K <alberk@gmail.com> wrote:
It tried adding this in the Post-Auth of the inner-tunnel but keep
getting
the following error.
Read "man unlang". And Alan's example again.
The unlang parser isn't smart. You can't just randomly add braces and reformat things. Follow existing examples. It really does help.
### Added Code if(LDAP-Group == "cn=hod,cn=users,dc=smartoptz,dc=com") {update reply
Why the heck are you putting the { on a new line, smashed up against the "update" text? Don't do that.
{ Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" } } else { udpate reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40" } }
This is all formatted badly. Don't do that.
if (LDAP-Group == "cn=hod,cn=users,dc=smartoptz,dc=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "30" } } else { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "40" } }
That will work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Nov 18, 2016, at 9:37 PM, Albert K <alberk@gmail.com> wrote:
Thank you for pointing out my mistake. Starting the curly bracket on a new line is a old habit of mine, just helps me to visually aligning up all the closing bracket. Did not know it was a big problem with the parser.
It's documented. See "man unlang". The parser is getting a bit smarter, but it's still imperfect. Alan DeKok.
...and my code/example shouldn't be taken verbosely. As stated, it's pseudo code... just to show you the sort of logic, comparison and setting of values. You are expected to read unlang man page and then the debug output of radiusd to see if it's working and whether it's working ;) alan
On 18/11/2016 10:46, Albert K wrote:
Hi,
I have want to the login user to be authorized according to their user grouping in Microsoft AD and also a catch all default. At the moment I am testing with two DEFAULT. Is it possible to do a Catch all DEFAULT. My example below only catch non hod group. Any help would be much appreciated. Thank you.
The first match causes subsequent matches to be skipped, unless you also set Fall-Through = Yes. So you can just change it to:
DEFAULT Ldap-Group == "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30"
DEFAULT Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40"
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Alan DeKok -
Albert K -
Brian Candler