How to reject users who don't match unlang
I have the following in my sites-available/default: authorize { ... # Allow only NET Staff members to log into BAND and HAPF if (Ldap-Group == "NET Staff" && (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4")) { update reply { Passport-Access-Priority = 6 } } # Reject everyone else elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") { reject = 1 } ... What I want is to only allow NET Staff members to log in and reject everyone else who tries to log into these resources. I'm getting the following in my log: Tue Mar 13 12:55:32 2012 : Info: ++? elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") -> TRUE Tue Mar 13 12:55:32 2012 : Info: ++- entering elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") {...} Tue Mar 13 12:55:32 2012 : Info: +++- elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") returns notfound Tue Mar 13 12:55:32 2012 : Info: ++- group authorize returns notfound What is the correct syntax to reject this way?
And of course I figured it out 2 minutes after writing this message. For posterity, the syntax was close. It's actually like this: elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") { reject = 1 }
hi, i must be tired....i cant see how that is different to your first email! ;-) alan
On 3/13/12 1:24 PM, "Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> wrote:
hi,
i must be tired....i cant see how that is different to your first email! ;-)
alan
No, you're right, I didn't edit it. It's like you said, reject without the "= 1" after it. I must be the one who is tired. Thank you for your reply.
participants (2)
-
Alan Buxey -
Scott McLane Gardner