populate a reply with ldap generic attributes
Hi, Using LDAP for both autorization and authentification, I learnt how to populate a reply request with generics in the autorize. Works fine. Now I am wondering if it would be possible to populate the reply with generics using a dn specified in an ldap attribute. The goal of this is to have predefined profiles to specify user rights (such as read-only, operator, admin, etc) specified only once and to refer to them into the user profile. Since these are generic attributes (of type radiusAttribute), I can't see anyway to use xlat for this. I would be pleased if someone could provide me any hint. Thanks. :Nicolas
On Mon, Nov 10, 2014 at 10:22 AM, Nicolas Edel <nicolas.edel@gmail.com> wrote:
Hi, Using LDAP for both autorization and authentification, I learnt how to populate a reply request with generics in the autorize. Works fine. Now I am wondering if it would be possible to populate the reply with generics using a dn specified in an ldap attribute. The goal of this is to have predefined profiles to specify user rights (such as read-only, operator, admin, etc) specified only once and to refer to them into the user profile. Since these are generic attributes (of type radiusAttribute), I can't see anyway to use xlat for this. I would be pleased if someone could provide me any hint. Thanks.
:Nicolas
To be more precise, the only solution I found for now is to use LDAP-Group comparison in post-auth and then updating reply according to the selected group. Eg: post-auth { if (control:LDAP-Group == "cn=cisco_readonly,ou=groups,ou=radius,dc=foo,dc=bar") { update reply { Cisco-AVPair = "shell:priv-lvl=1" } } } Now I'd like to retrieve the attributes (in post-auth or other, no matter) from within the directory itself instead of hard-coding them in the radius configuration. This is not a show stopper but it would really help. Thanks, :Nicolas
Nicolas Edel wrote:
Now I'd like to retrieve the attributes (in post-auth or other, no matter) from within the directory itself instead of hard-coding them in the radius configuration. This is not a show stopper but it would really help.
I don't think you can use an LDAP attribute to determine which *other* LDAP attribute to get RADIUS attributes from. That's very involved. Perhaps you could explain what you're trying to do. Talking about problems is more useful than asking why a solution doesn't work. There may be other solutions to the problem which you haven't seen. Alan DeKok.
On Mon, Nov 10, 2014 at 2:26 PM, Alan DeKok <aland@deployingradius.com> wrote:
Nicolas Edel wrote:
Now I'd like to retrieve the attributes (in post-auth or other, no matter) from within the directory itself instead of hard-coding them in the radius configuration. This is not a show stopper but it would really help.
I don't think you can use an LDAP attribute to determine which *other* LDAP attribute to get RADIUS attributes from. That's very involved.
Perhaps you could explain what you're trying to do. Talking about problems is more useful than asking why a solution doesn't work. There may be other solutions to the problem which you haven't seen.
I have dozens of network machines (routers, switches, fw, etc.) that use radius auth. All users info on this network are stored into an LDAP directory. Each one may have access to some machines with differents rights (denied, readonly, etc). For each machine I must be able to define a custom profile (ie with custom radius attributes) for any user, but they usually have a predefined profile set. The reasons of making each predefined profiles as a plain ldap leaf are: - it avoid data duplication - the propagation of any change in one of a predefined profile becomes automatic Hope my explanations are clear enough ... :Nicolas
On 10 Nov 2014, at 08:53, Nicolas Edel <nicolas.edel@gmail.com> wrote:
On Mon, Nov 10, 2014 at 2:26 PM, Alan DeKok <aland@deployingradius.com> wrote:
Nicolas Edel wrote:
Now I'd like to retrieve the attributes (in post-auth or other, no matter) from within the directory itself instead of hard-coding them in the radius configuration. This is not a show stopper but it would really help.
I don't think you can use an LDAP attribute to determine which *other* LDAP attribute to get RADIUS attributes from. That's very involved.
Perhaps you could explain what you're trying to do. Talking about problems is more useful than asking why a solution doesn't work. There may be other solutions to the problem which you haven't seen.
I have dozens of network machines (routers, switches, fw, etc.) that use radius auth. All users info on this network are stored into an LDAP directory. Each one may have access to some machines with differents rights (denied, readonly, etc). For each machine I must be able to define a custom profile (ie with custom radius attributes) for any user, but they usually have a predefined profile set.
The reasons of making each predefined profiles as a plain ldap leaf are: - it avoid data duplication - the propagation of any change in one of a predefined profile becomes automatic
Hope my explanations are clear enough ...
Yes, use the 'profiles' functionality which does exactly what you just specified. You add an attribute with the dn of a profile object to the user object https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avail... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Mon, Nov 10, 2014 at 3:20 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 10 Nov 2014, at 08:53, Nicolas Edel <nicolas.edel@gmail.com> wrote:
On Mon, Nov 10, 2014 at 2:26 PM, Alan DeKok <aland@deployingradius.com> wrote:
Nicolas Edel wrote:
Now I'd like to retrieve the attributes (in post-auth or other, no matter) from within the directory itself instead of hard-coding them in the radius configuration. This is not a show stopper but it would really help.
I don't think you can use an LDAP attribute to determine which *other* LDAP attribute to get RADIUS attributes from. That's very involved.
Perhaps you could explain what you're trying to do. Talking about problems is more useful than asking why a solution doesn't work. There may be other solutions to the problem which you haven't seen.
I have dozens of network machines (routers, switches, fw, etc.) that use radius auth. All users info on this network are stored into an LDAP directory. Each one may have access to some machines with differents rights (denied, readonly, etc). For each machine I must be able to define a custom profile (ie with custom radius attributes) for any user, but they usually have a predefined profile set.
The reasons of making each predefined profiles as a plain ldap leaf are: - it avoid data duplication - the propagation of any change in one of a predefined profile becomes automatic
Hope my explanations are clear enough ...
Yes, use the 'profiles' functionality which does exactly what you just specified.
You add an attribute with the dn of a profile object to the user object
https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avail...
damned, how did I missed this ... Many (many) thanks ! :Nicolas
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Nicolas Edel