pulling dn for User-Profile from ldap
Hi. I'd like to give users an option to specify which network to connect to using something like helpdesk\username@realm admins\username@realm I was thinking of stripping the network part in hints and saving it in a variable say Preferred-Network and then match on it in users DEFAULT Ldap-Group="%{Preferred-Network}" User-Profile := "%{Profile-DN}" Profile-DN would be matched to seeAlso in ldap.attr and seeAlso would be an attribute containing dn of the radius profile to be used for this group. However when I set it up I didn't see ldap module returning Profile-DN and I couldn't match against it. I guess I'm using the ldap module wrong but I'm not able to figure it out. thanks for any pointers martin
On 4 Jul 2013, at 18:33, Martin Kraus <lists_mk@wujiman.net> wrote:
Hi. I'd like to give users an option to specify which network to connect to using something like
helpdesk\username@realm admins\username@realm
I was thinking of stripping the network part in hints and saving it in a variable say Preferred-Network and then match on it in users
DEFAULT Ldap-Group="%{Preferred-Network}" User-Profile := "%{Profile-DN}"
That's missing a comma.
Profile-DN would be matched to seeAlso in ldap.attr
You mean mapped? Don't try and use the users file for complex stuff like this. In your profile objects add an attribute for preferredNetwork. Use ldap xlat to search in the directory for an profile object with a preferredNetwork attribute which matches the stripped path of the username, specify DN as the attribute to retrieve. Something like: authorize { update control { User-Profile := "%{ldap:ldap:///<base dn>?DN?sub?prefferedNetwork=%{<your_preferred_network_attr>}}" } if (!control:User-Profile) { reject # or whatever you want to do for this case } ldap } But even that's kinda slow. You might want to take a look at using the caching module with %{<your_preferred_network_attr>} as the key. Then at least you avoid the lookup for the profile DN every time. If the ldap_xlat DN thing doesn't work (I think you can retrieve the DN using the attribute list, but not 100%) I can add a hack to 3.0 for it. But you'll need to upgrade. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On Thu, Jul 04, 2013 at 07:05:09PM +0100, Arran Cudbard-Bell wrote:
Don't try and use the users file for complex stuff like this.
In your profile objects add an attribute for preferredNetwork.
Use ldap xlat to search in the directory for an profile object with a preferredNetwork attribute which matches the stripped path of the username, specify DN as the attribute to retrieve.
Something like:
authorize { update control { User-Profile := "%{ldap:ldap:///<base dn>?DN?sub?prefferedNetwork=%{<your_preferred_network_attr>}}" }
if (!control:User-Profile) { reject # or whatever you want to do for this case }
ldap }
Hi. Thanks for the pointers. I actually needed to search for group membership as well as the group name: User-Profile := "%{ldap-main:ldap:///ou=groups,dc=wuji,dc=cz?seeAlso?sub?(&(cn=%{Preferred-Network})(uniqueMember=%{control:Ldap-UserDn}))}" This checks whether the current user is a member of the group he/she sent as preferred and returns the pointer to the group radius profile. I'm of course hitting a problem with eap where it complains that the eap identity is different from the User-Name, because I'm changing User-Name in hints file but I'll work around it somehow. thanks again Martin
participants (2)
-
Arran Cudbard-Bell -
Martin Kraus