LDAP-defined huntrgroups: docs, pointers, anything?
Hello all We are working on a setup with freeradius using freeipa's ldap-server as a backend for freeradius. I have successufully expanded det LDAP-schema with radius-attributes, etc. Users, usergroups and clients (IPs and secrets) can be defined via ldap. I am hoping to be able to define huntgroups as well, but I have not found any detailed information on how to procceed. There is this howto for SQL-based backends, and random searches and LLM-queries don't get me any further: https://wiki.freeradius.org/guide/SQL-Huntgroup-HOWTO I am not certain if this really is a question for the user list or the devel list, but I can try both. More details: I was hoping to use a standard memberOf in my client-definition. CLIENT: dn: fqdn=[NAS-NAME].[base_domain],cn=computers,cn=accounts,[base_dn] objectClass: ieee802Device objectClass: ipaHost objectClass: ipaObject objectClass: ipaService objectClass: ipaSshGroupOfPubKeys objectClass: ipaSshHost objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: nsHost objectClass: pkiUser objectClass: radiusClient objectClass: radiusProfile objectClass: top cn: [FQDN] fqdn: [FQDN] memberOf: cn=radius_huntgroup,cn=hostgroups,cn=accounts,[base_dn] radiusClientSecret: Testing321 radiusClientIPAddress: 192.168.0.80 serverHostName: [NAS-NAME] "HOST/HUNTGROUP": dn: cn=radius_huntgroup,cn=hostgroups,cn=accounts,[base_dn] objectClass: groupOfNames objectClass: ipahostgroup objectClass: ipaobject objectClass: mepOriginEntry objectClass: nestedGroup objectClass: top cn: radius_huntgroup member: fqdn=[NAS-NAME].[base_domain],cn=computers,cn=accounts,[base_dn] So basically I want one huntgroup entry, for every group defined inn: cn=hostgroups,cn=accounts,[base_dn] With NASes defined in: cn=computers,cn=accounts,[base_dn] And their relevant IP addresses: radiusClientIPAddress: 192.168.0.80 There are some very old posts, in the mailinglist discussing similar topics, but I am not found anything usefull there neither. -- Best Regards Jostein Fossheim
Please only send messages to one list. There is no need to send the same messages to multiple lists. On Mar 5, 2025, at 7:01 AM, Jostein Fossheim via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
We are working on a setup with freeradius using freeipa's ldap-server as a backend for freeradius.
I have successufully expanded det LDAP-schema with radius-attributes, etc.
That's good.
Users, usergroups and clients (IPs and secrets) can be defined via ldap. I am hoping to be able to define huntgroups as well, but I have not found any detailed information on how to procceed.
The "huntgroups" file format goes back to 1993. It's defined for local files, and there's no similar functionality for LDAP.
There is this howto for SQL-based backends, and random searches and LLM-queries don't get me any further:
https://wiki.freeradius.org/guide/SQL-Huntgroup-HOWTO
I am not certain if this really is a question for the user list or the devel list, but I can try both.
Please just post to one list. The list description for the "devel" list says that it's for people modifying the server source. For doing huntgroup-style configuration in LDAP, you will need to define the LDAP schema and queries yourself. Then, write them in unlang policies. And please submit the results back. We can include them in future releases. Alan DeKok.
On 2025-03-05 13:07, Alan DeKok wrote:
There is this howto for SQL-based backends, and random searches and LLM-queries don't get me any further:
https://wiki.freeradius.org/guide/SQL-Huntgroup-HOWTO
I am not certain if this really is a question for the user list or the devel list, but I can try both.
For doing huntgroup-style configuration in LDAP, you will need to define the LDAP schema and queries yourself. Then, write them in unlang policies.
And please submit the results back. We can include them in future releases.
Alan DeKok.
So what you are saying is that I can do ldap-queries directly in unlang, this the best refference/doc I have: https://www.freeradius.org/radiusd/man/unlang.html https://www.freeradius.org/documentation/freeradius-server/3.2.8/unlang/inde... Do you (or anyone) know of any examples that I can use, to master those queries quicker? I find some vague hints in the ldap-module section: https://www.freeradius.org/documentation/freeradius-server/4.0~alpha1/raddb/... I assume that I can follow the same logic as in the SQL-howto from my original post (above)? - Locate the |authorize { }| section in your radiusd.conf or sites-enabled/defaut configuration. - After the preprocess module insert the following update request { Huntgroup-Name := "%{sql:SELECT |groupname| FROM |radhuntgroup| WHERE nasipaddress='%{NAS-IP-Address}'}" } And the basic logic of my query should be: 1. Query for all huntgroups in the tree containing hostgroups: cn=computers,cn=accounts,[base_dn] 2. Do a second query for each member defined in the group (freeipa uses both member and memberOf), to check if any of the members (hosts/NASes) have radiusClientIPAddress= %{NAS-IP-Address} defined, if yes, the connecting NAS is a member of one or more huntrgroups? I will report back if I am sucessfull. We also did some work so that we could import the radius-schema directly into freeIPA, if this would be interesting for anyone, we could share the results as well. -- Jostein Fossheim
On Mar 5, 2025, at 8:19 AM, Jostein Fossheim via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote: So what you are saying is that I can do ldap-queries directly in unlang,
Yes.
this the best refference/doc I have: https://www.freeradius.org/radiusd/man/unlang.html https://www.freeradius.org/documentation/freeradius-server/3.2.8/unlang/inde... Do you (or anyone) know of any examples that I can use, to master those queries quicker? I find some vague hints in the ldap-module section:
You can do LDAP queries in v3 with the syntax: %{ldap:...} Just replace the "..." with the LDAP query.
https://www.freeradius.org/documentation/freeradius-server/4.0~alpha1/raddb/... I assume that I can follow the same logic as in the SQL-howto from my original post (above)?
Don't follow the v4 docs for v3, but yes. Just write "unlang" policies to check things in LDAP, and make decisions based on the result.
- Locate the |authorize { }| section in your radiusd.conf or sites-enabled/defaut configuration. - After the preprocess module insert the following update request { Huntgroup-Name := "%{sql:SELECT |groupname| FROM |radhuntgroup| WHERE nasipaddress='%{NAS-IP-Address}'}" }
And the basic logic of my query should be:
1. Query for all huntgroups in the tree containing hostgroups:
cn=computers,cn=accounts,[base_dn]
2. Do a second query for each member defined in the group (freeipa uses both member and memberOf), to check if any of the members (hosts/NASes) have radiusClientIPAddress= %{NAS-IP-Address} defined, if yes, the connecting NAS is a member of one or more huntrgroups?
You should be able to combine both of those searches into one LDAP query. Test the queries with the command-line ldapsearch tool. Then, take the queries, add some dynamic expansions, and add them to FreeRADIUS. That's the easiest way to test.
I will report back if I am sucessfull.
We also did some work so that we could import the radius-schema directly into freeIPA, if this would be interesting for anyone, we could share the results as well.
That would be good, thanks. Alan DeKok.
Test the queries with the command-line ldapsearch tool. Then, take the queries, add some dynamic expansions, and add them to FreeRADIUS. That's the easiest way to test.
Did some basic tests from the command line: I have defined one NAS/client in our lab-setup with IP 172.17.10.112, which is a member of two "huntgroups" (hostgroups in FreeIPA), and I can either get them in one query or two queries. Like this: # One query: $ ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" memberOf | grep -v "^dn: " memberOf: cn=radius_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net # Two queries: $ "ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" fqdn | grep -v "^dn: " fqdn: valkyrie3.lab.skyfritt.net $ ldapsearch -LLLQ -o ldif_wrap=no "(member=*valkyrie3.lab.skyfritt.net*)" cn | grep -v "^dn: " cn: radius_huntgroup cn: radius_second_huntgroup So huntgroups should be doable, after the model form the SQL-howto. Best Regards, Jostein Fossheim
On Mar 5, 2025, at 1:59 PM, Jostein Fossheim <jfossheim@skyfritt.net> wrote:
Did some basic tests from the command line:
I have defined one NAS/client in our lab-setup with IP 172.17.10.112, which is a member of two "huntgroups" (hostgroups in FreeIPA), and I can either get them in one query or two queries. Like this:
# One query: $ ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" memberOf | grep -v "^dn: " memberOf: cn=radius_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net
# Two queries: $ "ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" fqdn | grep -v "^dn: " fqdn: valkyrie3.lab.skyfritt.net
$ ldapsearch -LLLQ -o ldif_wrap=no "(member=*valkyrie3.lab.skyfritt.net*)" cn | grep -v "^dn: " cn: radius_huntgroup cn: radius_second_huntgroup
So huntgroups should be doable, after the model form the SQL-howto.
That's good news! Alan DeKok.
On 05/03/2025 20:34, Alan DeKok wrote:
On Mar 5, 2025, at 1:59 PM, Jostein Fossheim <jfossheim@skyfritt.net> wrote:
Did some basic tests from the command line:
I have defined one NAS/client in our lab-setup with IP 172.17.10.112, which is a member of two "huntgroups" (hostgroups in FreeIPA), and I can either get them in one query or two queries. Like this:
# One query: $ ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" memberOf | grep -v "^dn: " memberOf: cn=radius_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net
# Two queries: $ "ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" fqdn | grep -v "^dn: " fqdn: valkyrie3.lab.skyfritt.net
$ ldapsearch -LLLQ -o ldif_wrap=no "(member=*valkyrie3.lab.skyfritt.net*)" cn | grep -v "^dn: " cn: radius_huntgroup cn: radius_second_huntgroup
So huntgroups should be doable, after the model form the SQL-howto. That's good news! I see that the exact structure/syntax for doing ldap-queries in unlang is somewhat different from the ldapsearch tool, but goes via standard ldap-urls, like this bellow. I tested with a reply-message in the post-auth section that queries for my full name:
update reply { Reply-Message += "Welcome to our realm %{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?displayName?sub?(uid=%{User-Name})}" } Which indeed delivers the following output after successful authentication: Reply-Message = "Welcome to our realm Jostein Fossheim (lab)" I do believe that I have the proper know-how to produce/emulate my huntgroups after the SQL example now. Will make an attempt tomorrow. Thank you for the pointers, Jostein Fossheim
On 2025-03-05 23:31, Jostein Fossheim via Freeradius-Users wrote:
On 05/03/2025 20:34, Alan DeKok wrote:
On Mar 5, 2025, at 1:59 PM, Jostein Fossheim <jfossheim@skyfritt.net> wrote:
Did some basic tests from the command line:
I have defined one NAS/client in our lab-setup with IP 172.17.10.112, which is a member of two "huntgroups" (hostgroups in FreeIPA), and I can either get them in one query or two queries. Like this:
# One query: $ ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" memberOf | grep -v "^dn: " memberOf: cn=radius_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net
# Two queries: $ "ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" fqdn | grep -v "^dn: " fqdn: valkyrie3.lab.skyfritt.net
$ ldapsearch -LLLQ -o ldif_wrap=no "(member=*valkyrie3.lab.skyfritt.net*)" cn | grep -v "^dn: " cn: radius_huntgroup cn: radius_second_huntgroup
So huntgroups should be doable, after the model form the SQL-howto. That's good news! I see that the exact structure/syntax for doing ldap-queries in unlang is somewhat different from the ldapsearch tool, but goes via standard ldap-urls, like this bellow. I tested with a reply-message in the post-auth section that queries for my full name:
update reply { Reply-Message += "Welcome to our realm %{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?displayName?sub?(uid=%{User-Name})}"
}
Almost there! I am able to sucessfully add the first HuntGroup from my query, so if a NAS is only member of one ldap-group, everything seems to be ok now, but I want multiple groups, if posible. I can do something like this: update request { Huntgroup-Name := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(member=*valkyrie3.lab.skyfritt.net*)}" Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*valkyrie3.lab.skyfritt.net*)(!(cn=%{Huntgroup-Name})))}" } Then Huntgroup-Name will contain both radius_huntgroup and radius_second_huntgroup, but I am uncertain on how to expand this trick into handeling more groups. The ldap-query seems only to report back one group, but it should report back two. Can I handle this with a foreach, or is the query-functionality limited here? -- Best Regards Jostein Fossheim
On 2025-03-06 10:06, Jostein Fossheim via Freeradius-Users wrote:
On 2025-03-05 23:31, Jostein Fossheim via Freeradius-Users wrote:
On 05/03/2025 20:34, Alan DeKok wrote:
On Mar 5, 2025, at 1:59 PM, Jostein Fossheim <jfossheim@skyfritt.net> wrote:
Did some basic tests from the command line:
I have defined one NAS/client in our lab-setup with IP 172.17.10.112, which is a member of two "huntgroups" (hostgroups in FreeIPA), and I can either get them in one query or two queries. Like this:
# One query: $ ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" memberOf | grep -v "^dn: " memberOf: cn=radius_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net
memberOf: cn=radius_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=hostgroups,cn=accounts,dc=lab,dc=skyfritt,dc=net memberOf: cn=radius_second_huntgroup,cn=ng,cn=alt,dc=lab,dc=skyfritt,dc=net
# Two queries: $ "ldapsearch -LLLQ -o ldif_wrap=no "(radiusClientIPAddress=172.17.10.112)" fqdn | grep -v "^dn: " fqdn: valkyrie3.lab.skyfritt.net
$ ldapsearch -LLLQ -o ldif_wrap=no "(member=*valkyrie3.lab.skyfritt.net*)" cn | grep -v "^dn: " cn: radius_huntgroup cn: radius_second_huntgroup
So huntgroups should be doable, after the model form the SQL-howto. That's good news! I see that the exact structure/syntax for doing ldap-queries in unlang is somewhat different from the ldapsearch tool, but goes via standard ldap-urls, like this bellow. I tested with a reply-message in the post-auth section that queries for my full name:
update reply { Reply-Message += "Welcome to our realm %{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?displayName?sub?(uid=%{User-Name})}"
}
Almost there!
I am able to sucessfully add the first HuntGroup from my query, so if a NAS is only member of one ldap-group, everything seems to be ok now, but I want multiple groups, if posible. I can do something like this:
update request { Huntgroup-Name := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(member=*valkyrie3.lab.skyfritt.net*)}" Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*valkyrie3.lab.skyfritt.net*)(!(cn=%{Huntgroup-Name})))}" }
Then Huntgroup-Name will contain both radius_huntgroup and radius_second_huntgroup, but I am uncertain on how to expand this trick into handeling more groups.
The ldap-query seems only to report back one group, but it should report back two. Can I handle this with a foreach, or is the query-functionality limited here?
The following code handles HuntGroups in my setup, I have still not handled multiple HuntGroups, which should be doable, but I have the trick for showing two groups. update request { Huntgroup-Name := "testgroup" Tmp-String-0 := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?fqdn?sub?(radiusClientIPAddress=%{NAS-IP-Address})}" } update request { Huntgroup-Name := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(member=*%{Tmp-String-0}*)}" Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*%{Tmp-String-0}*)(!(cn=%{Huntgroup-Name})))}" } update reply { Reply-Message += "NAS-IP-Address is: %{NAS-IP-Address}" } update reply { Reply-Message += "NAS-FQDN is: %{Tmp-String-0}" } foreach &Huntgroup-Name { update reply { Reply-Message += "NAS is a member of Huntgroup: %{Foreach-Variable-0}" } } I probably need some help with my query, from someone with more unlang-experience. -- Best Regards, Jostein Fossheim
The following code handles HuntGroups in my setup, I have still not handled multiple HuntGroups, which should be doable, but I have the trick for showing two groups.
update request { Huntgroup-Name := "testgroup" Tmp-String-0 := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?fqdn?sub?(radiusClientIPAddress=%{NAS-IP-Address})}" }
update request { Huntgroup-Name := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(member=*%{Tmp-String-0}*)}" Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*%{Tmp-String-0}*)(!(cn=%{Huntgroup-Name})))}" }
update reply { Reply-Message += "NAS-IP-Address is: %{NAS-IP-Address}" }
update reply { Reply-Message += "NAS-FQDN is: %{Tmp-String-0}" }
foreach &Huntgroup-Name { update reply { Reply-Message += "NAS is a member of Huntgroup: %{Foreach-Variable-0}" } }
I probably need some help with my query, from someone with more unlang-experience.
My final attempt to handle up to five huntgroups per NAS: update request { Huntgroup-Name := "testgroup" Tmp-String-0 := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?fqdn?sub?(radiusClientIPAddress=%{NAS-IP-Address})}" } update request { # First huntgroup Huntgroup-Name := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(member=*%{Tmp-String-0}*)}" } # Only try for a second huntgroup if the first one was found if ("%{Huntgroup-Name[0]}" != "") { update request { Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*%{Tmp-String-0}*)(!(cn=%{Huntgroup-Name[0]})))}" Huntgroup-Name -= "" # Remove any empty values } } # Only try for a third huntgroup if the second one was found if ("%{Huntgroup-Name[1]}" != "") { update request { Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*%{Tmp-String-0}*)(!(cn=%{Huntgroup-Name[0]}))(!(cn=%{Huntgroup-Name[1]})))}" Huntgroup-Name -= "" # Remove any empty values } } # Only try for a fourth huntgroup if the third one was found if ("%{Huntgroup-Name[2]}" != "") { update request { Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*%{Tmp-String-0}*)(!(cn=%{Huntgroup-Name[0]}))(!(cn=%{Huntgroup-Name[1]}))(!(cn=%{Huntgroup-Name[2]})))}" Huntgroup-Name -= "" # Remove any empty values } } # Only try for a fifth huntgroup if the fourth one was found if ("%{Huntgroup-Name[3]}" != "") { update request { Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(&(member=*%{Tmp-String-0}*)(!(cn=%{Huntgroup-Name[0]}))(!(cn=%{Huntgroup-Name[1]}))(!(cn=%{Huntgroup-Name[2]}))(!(cn=%{Huntgroup-Name[3]})))}" Huntgroup-Name -= "" # Remove any empty values } } I either have to find a way to get multiple huntgroups returned, from my query, or do a better kind of loop to handle even more huntgroups. Any other inputs or suggestions is greatly appreciated -- Best Regards Jostein Fossheim
On Mar 6, 2025, at 6:10 AM, Jostein Fossheim via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
My final attempt to handle up to five huntgroups per NAS:
Why not just search for _all_ NAS names, and return the values as a string? You can then split the string apart in unlang. I don't know enough about LDAP to suggest changes to the queries, but it should work in theory. Something like "cn=*" may work. Or, create a second LDAP module which just runs the hunt group queries. That will result in more connections to the LDAP server, but that shouldn't be a problem. You can then use the LDAP module 'update' section to add multiple huntgoup names. Alan DeKok.
On 2025-03-06 13:45, Alan DeKok wrote:
On Mar 6, 2025, at 6:10 AM, Jostein Fossheim via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
My final attempt to handle up to five huntgroups per NAS: Why not just search for _all_ NAS names, and return the values as a string? You can then split the string apart in unlang. I don't know enough about LDAP to suggest changes to the queries, but it should work in theory. Something like "cn=*" may work.
Or, create a second LDAP module which just runs the hunt group queries. That will result in more connections to the LDAP server, but that shouldn't be a problem. You can then use the LDAP module 'update' section to add multiple huntgoup names.
Alan DeKok.
That is the strange part, i would assume that this would do the trick to get all the values: update request { Huntgroup-Name := "testgroup" Tmp-String-0 := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?fqdn?sub?(radiusClientIPAddress=%{NAS-IP-Address})}" } update request { Huntgroup-Name += "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?cn?sub?(member=*%{Tmp-String-0}*)}" } If I run the query via the command line: $ ldapsearch -LLLQ -o ldif_wrap=no -b "cn=accounts,dc=lab,dc=skyfritt,dc=net" "(radiusClientIPAddress=172.17.10.112)" fqdn | grep -v "^dn:" fqdn: valkyrie3.lab.skyfritt.net $ ldapsearch -LLLQ -o ldif_wrap=no -b "cn=accounts,dc=lab,dc=skyfritt,dc=net" "(member=*valkyrie3.lab.skyfritt.net*)" cn | grep -v "^dn:" cn: radius_huntgroup cn: radius_second_huntgroup cn: radius_third_huntgroup cn: radius_fourth_huntgroup cn: radius_fifth_huntgroup It returns this, but when I do the query above, in the authorize-section, i am only able to get one/the first value back, so it might be a limitation in the query-function. Huntgroup-Name := "%{ldap:ldap:///cn=accounts,dc=lab,dc=skyfritt,dc=net?fqdn?sub?(radiusClientIPAddress=%{NAS-IP-Address})}" I am uncertain on how to do a better search, and I have to do a deeper investigation into you're second suggestion. I hope to have a solution ready for deployment in a couple of weeks, since both my own company and several customers wants this working. But it might for all practical purposes be enough that a NAS can be a member of five different huntgroups. After all I do believe that there is a limitation on one group per NAS, in the original implementation (but I might be wrong on that) Output from radtest, which loops through the the Hountgroup-Name attribute: Received Access-Accept Id 148 from 172.17.251.110:1812 to 172.17.10.112:50114 length 3758 Reply-Message = "NAS-FQDN is: valkyrie3.lab.skyfritt.net" Reply-Message = "NAS-IP-Address is: 172.17.10.112" Reply-Message = "NAS is a member of Huntgroup: radius_huntgroup" Reply-Message = "NAS is a member of Huntgroup: radius_second_huntgroup" Reply-Message = "NAS is a member of Huntgroup: radius_third_huntgroup" Reply-Message = "NAS is a member of Huntgroup: radius_fourth_huntgroup" Reply-Message = "NAS is a member of Huntgroup: radius_fifth_huntgroup" -- Best Regards, Jostein Fossheim
On Mar 6, 2025, at 8:19 AM, Jostein Fossheim <jfossheim@skyfritt.net> wrote:
That is the strange part, i would assume that this would do the trick to get all the values: ... It returns this, but when I do the query above, in the authorize-section, i am only able to get one/the first value back, so it might be a limitation in the query-function.
Yes, that's a limitation of the query function in v3. Happily, we've fixed that in v4. It can deal with multiple return values, and create multiple attributes. Alan DeKok.
On 2025-03-06 14:31, Alan DeKok wrote:
On Mar 6, 2025, at 8:19 AM, Jostein Fossheim<jfossheim@skyfritt.net> wrote:
That is the strange part, i would assume that this would do the trick to get all the values: ... It returns this, but when I do the query above, in the authorize-section, i am only able to get one/the first value back, so it might be a limitation in the query-function. Yes, that's a limitation of the query function in v3.
Happily, we've fixed that in v4. It can deal with multiple return values, and create multiple attributes.
Alan DeKok.
Good to have that clearified, my current approach will do for now, it would be nice to create a howto after the SQL-example, since this approach is modeled after the one there. We have a quite beautifull integration with freeIPA running in our lab Enviroment now, we are also planning to create add ons, so we can update radius attributes directly in the IPA WebGUI or the CLI. Do you know if HuntGroups from the configuration files can handle multiple huntgroups per NAS ? -- Best Regards, Jostein Fossheim
On Mar 6, 2025, at 8:37 AM, Jostein Fossheim <jfossheim@skyfritt.net> wrote:
Good to have that clearified, my current approach will do for now, it would be nice to create a howto after the SQL-example, since this approach is modeled after the one there.
As always, patches are welcome/
We have a quite beautifull integration with freeIPA running in our lab Enviroment now, we are also planning to create add ons, so we can update radius attributes directly in the IPA WebGUI or the CLI. Do you know if HuntGroups from the configuration files can handle multiple huntgroups per NAS ?
Yes. Alan DeKok.
participants (2)
-
Alan DeKok -
Jostein Fossheim