Hi all, I am pretty new to freeradius so please bear with me. Version 3.0.11 I am using the python module to return a DN based off the caller IP: def authorize(p): print "*** authorize ***" ip = getValue(p,'NAS-IP-Address') if ip == xxx.xxx.xxx.xxx: LDAPBaseDN = 'OU=MIS,OU=Auth,DC=ldap,DC=xx,DC=xx,DC=xx else: LDAPBaseDN = 'OU=Radius,OU=Auth,DC=ldap,DC=xx,DC=xx,DC=xx #LDAPBaseDN = 'OURadius' radiusd.radlog(radiusd.L_INFO, '*** radlog call in authorize ***') reply = (('Tmp-String-0',LDAPBaseDN),) return (radiusd.RLM_MODULE_OK, reply, None) This works and returns: *** authorize *** *** radlog call in authorize *** rlm_python:authorize: 'reply:Tmp-String-0' = 'OU=Radius,OU=Auth,DC=ldap,DC=xx,DC=xx,DC=xx' (0) [python] = ok But the problem lies in the ldap module by where I am trying to access the value in order to formulate my base_dn value: base_dn = "%{reply:Tmp-String-0}" The DN is escaped and obviously the the ldap bind fails due to the escaping: ldap: EXPAND %{reply:Tmp-String-0} (0) ldap: --> OU\3dRadius\2cOU\3dAuth\2cDC\3dldap\2cDC\3dxx\2cDC\3dxx\2cDC\3dxx (0) ldap: Performing search in "OU\3dRadius\2cOU\3dAuth\2cDC\3dldap\2cDC\3dxx\2cDC\3dxx\2cDC\3dxx" with filter "(CN=radius)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: ERROR: Failed performing search: Invalid DN syntax I have tried using the ldap unescape method but to no joy. Please can someone help? Thanks, Rob -------------------------------------------------------------------- Un o'r 4 prifysgol uchaf yn y DU a'r gorau yng Nghymru am fodlonrwydd myfyrwyr (Arolwg Cenedlaethol y Myfyrwyr 2016) www.aber.ac.uk Top 4 UK university and best in Wales for student satisfaction (National Student Survey 2016) www.aber.ac.uk
On Sep 16, 2016, at 9:58 AM, Rob Johnson [rbj] <rbj@aber.ac.uk> wrote:
I am using the python module to return a DN based off the caller IP:
The problem is that the LDAP module doesn't trust attributes by default. It only trusts it's configuration, which comes from the configuration file. There is no simple way in v3 to dynamically create the DN. Alan DeKok.
On 16 Sep 2016, at 10:04, Alan DeKok <aland@deployingradius.com> wrote:
On Sep 16, 2016, at 9:58 AM, Rob Johnson [rbj] <rbj@aber.ac.uk> wrote:
I am using the python module to return a DN based off the caller IP:
The problem is that the LDAP module doesn't trust attributes by default. It only trusts it's configuration, which comes from the configuration file.
There is no simple way in v3 to dynamically create the DN.
If you pass it in as an attribute reference it isn’t escaped… Just means use the raw value of this attribute. -Arran
Thanks Arran, Have you any idea how this can be achieved in practice? Cheers, Rob -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+rbj=aber.ac.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 16 September 2016 20:05 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: LDAP distinguished name escaping
On 16 Sep 2016, at 10:04, Alan DeKok <aland@deployingradius.com> wrote:
On Sep 16, 2016, at 9:58 AM, Rob Johnson [rbj] <rbj@aber.ac.uk> wrote:
I am using the python module to return a DN based off the caller IP:
The problem is that the LDAP module doesn't trust attributes by default. It only trusts it's configuration, which comes from the configuration file.
There is no simple way in v3 to dynamically create the DN.
If you pass it in as an attribute reference it isn’t escaped… Just means use the raw value of this attribute. -Arran
On 19 Sep 2016, at 12:07, Rob Johnson [rbj] <rbj@aber.ac.uk> wrote:
Thanks Arran,
Have you any idea how this can be achieved in practice? Yeah, just use an attribute reference i.e. &my-attribute, in place of the double quoted string in the config.
Only a small subset of config items work with it though. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks for the pointer Arran, For reference, I replaced: base_dn = "%{reply:Tmp-String-0}" with base_dn = &reply:Tmp-String-0 in the ldap module and the string is no longer escaped! Cheers, Rob -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+rbj=aber.ac.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 19 September 2016 10:32 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: LDAP distinguished name escaping
On 19 Sep 2016, at 12:07, Rob Johnson [rbj] <rbj@aber.ac.uk> wrote:
Thanks Arran,
Have you any idea how this can be achieved in practice? Yeah, just use an attribute reference i.e. &my-attribute, in place of the double quoted string in the config.
Only a small subset of config items work with it though. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Why use the python? Just do it all with an ldap module instance, using it to get your value natively ? alan
participants (4)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Rob Johnson [rbj]