FR: 1.1.2 Openldap 2.3.X I tried to do regex match in Ldap-Group. From below users file, The "NAS-Identifier" regex works OK but for Ldap-Group match, it's not working as below DEBUG log. value to match (jarService = Y5-IPOH, NAS-Identifier=Y5-IPOH) Users file ======= NAS-Identifier =~ "Y5", ldapmain1-Ldap-Group =~ "Y5", Autz-Type := Y5 radiusd.conf ========= ldap ldapmain1 { .............. groupname_attribute = jarService groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } Debug: ===== rlm_ldap: performing search in ou=CUSTOMER,ou=People,dc=xxxxx,dc=xx, with filter (&(jarService=Y5)(&(uid=bacang)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result --haizam
Rohaizam Abu Bakar wrote:
I tried to do regex match in Ldap-Group. From below users file, The "NAS-Identifier" regex works OK but for Ldap-Group match, it's not working as below DEBUG log.
It doesn't work like that. The match is "IF the user is in the named group". See src/modules/rlm_ldap/rlm_ldap.c, function ldap_groupcmp(). If you want it to do a regex match, you'll have to modify the code in rlm_ldap. Alan DeKok.
On Tue, 19 Feb 2008, Alan DeKok wrote:
Rohaizam Abu Bakar wrote:
I tried to do regex match in Ldap-Group. From below users file, The "NAS-Identifier" regex works OK but for Ldap-Group match, it's not working as below DEBUG log.
It doesn't work like that. The match is "IF the user is in the named group". See src/modules/rlm_ldap/rlm_ldap.c, function ldap_groupcmp().
If you want it to do a regex match, you'll have to modify the code in rlm_ldap.
Also not that LDAP typically doesnt allow substring search on any given attribute. My solution is to use a seperate script to perform a search in LDAP using ldap-search and output whatever you need in the attribute. Example, I have LDAP users in either ou=group1,ou=test,o=bla, or ou=group2,ou=test,o=bla, and there are no other LDAP-attributes to grab: ---- #! /bin/sh # /usr/sbin/ldap2vlan GROUP=$(ldapsearch -x -LLL -h 10.0.0.92 -b ou=test,o=bla \ -D cn=admin,ou=test,o=bla -W mypasswd \ '(cn='${1}')' dn | sed -n 's/,ou=test,o=bla//;s/.*=//p') test "${GROUP" = "group1" && echo -n 110 && exit 0 test "${GROUP" = "group2" && echo -n 120 && exit 0 ---- And then in the users file I have DEFAULT Freeradius-Proxied-To == 127.0.0.1 Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = `%{exec:/usr/sbin/ldap2vlan %{User-Name}` Tunnel-Private-Group-Id will then either be "110" or "120" depending on whether user is found in group1 or group2 (and group1 if found in both) Hope this helps... :) -- Kolbjørn Barmen UNINETT Driftsenter
Noted & TQ. Will try the proposed solution. --haizam ----- Original Message ----- From: "Kolbjørn Barmen" <kolbjorn.barmen@uninett.no> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, February 19, 2008 6:07 PM Subject: Re: Regex Ldap Group
On Tue, 19 Feb 2008, Alan DeKok wrote:
Rohaizam Abu Bakar wrote:
I tried to do regex match in Ldap-Group. From below users file, The "NAS-Identifier" regex works OK but for Ldap-Group match, it's not working as below DEBUG log.
It doesn't work like that. The match is "IF the user is in the named group". See src/modules/rlm_ldap/rlm_ldap.c, function ldap_groupcmp().
If you want it to do a regex match, you'll have to modify the code in rlm_ldap.
Also not that LDAP typically doesnt allow substring search on any given attribute.
My solution is to use a seperate script to perform a search in LDAP using ldap-search and output whatever you need in the attribute.
Example, I have LDAP users in either ou=group1,ou=test,o=bla, or ou=group2,ou=test,o=bla, and there are no other LDAP-attributes to grab:
---- #! /bin/sh # /usr/sbin/ldap2vlan GROUP=$(ldapsearch -x -LLL -h 10.0.0.92 -b ou=test,o=bla \ -D cn=admin,ou=test,o=bla -W mypasswd \ '(cn='${1}')' dn | sed -n 's/,ou=test,o=bla//;s/.*=//p')
test "${GROUP" = "group1" && echo -n 110 && exit 0 test "${GROUP" = "group2" && echo -n 120 && exit 0 ----
And then in the users file I have
DEFAULT Freeradius-Proxied-To == 127.0.0.1 Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = `%{exec:/usr/sbin/ldap2vlan %{User-Name}`
Tunnel-Private-Group-Id will then either be "110" or "120" depending on whether user is found in group1 or group2 (and group1 if found in both)
Hope this helps... :)
-- Kolbjørn Barmen UNINETT Driftsenter - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Kolbjørn Barmen -
Rohaizam Abu Bakar