Help with configuring for multiple DC for LDAP
I want to set up my FreeRADIUS server to check the supplied user name and decide which DC to use for authentication. I have tried using the following code in my authorize section of a custom sites-enabled file. # Check if the User-Name contains an email if ("%{User-Name}" =~ /@(.+)$/) { # Extract domain from email and store in email_domain set email_domain = "%{1}" # Conditionally set dc based on the domain if ("%{email_domain}" == "student.madeupdomain.com") { update control { LDAP-Base-DN := "dc=student,dc=madeupdomain,dc=com" } } else { update control { LDAP-Base-DN := "dc=madeupdomain,dc=com" } } } With this code in the custom file, the server gives an error message of "Expecting section start brace '{' after "set email_domain". I have tried adding a start brace before the if statement to assign the DC to use, but that has made no difference. To check, I tried ChatGPT and put this code in. ChatGPT says the code is correct. Wayne Sprouse -- "The foregoing electronic message and any files transmitted with it are confidential and are intended only for the use of the intended recipient named above. This communication may contain material protected by the Family Educational Rights and Privacy Act (FERPA). If you are not the intended recipient, copying, distribution or use of the contents of this message is strictly prohibited. If you received this electronic message in error, please notify us immediately at (228-864-1146**)."**
On Apr 10, 2025, at 10:51 AM, Wayne Sprouse via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I want to set up my FreeRADIUS server to check the supplied user name and decide which DC to use for authentication. I have tried using the following code in my authorize section of a custom sites-enabled file.
# Check if the User-Name contains an email if ("%{User-Name}" =~ /@(.+)$/) { # Extract domain from email and store in email_domain set email_domain = "%{1}"
You can't just invent things and expect them to work. The configuration files and Unlang are extensively documented. If you want to define local attributes, then read raddb/dictionary, and follow the instructions there. Alan DeKok.
I had created the attribute email_domain as a string field in the dictionary file before sending this help request. I read numerous discussions online regarding using an email address to determine which domain to authenticate against. I was not "just inventing things and expecting them to work" but using examples others shared that worked for them. Wayne Sprouse On Thu, Apr 10, 2025 at 1:01 PM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 10, 2025, at 10:51 AM, Wayne Sprouse via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
I want to set up my FreeRADIUS server to check the supplied user name and decide which DC to use for authentication. I have tried using the
following
code in my authorize section of a custom sites-enabled file.
# Check if the User-Name contains an email if ("%{User-Name}" =~ /@(.+)$/) { # Extract domain from email and store in email_domain set email_domain = "%{1}"
You can't just invent things and expect them to work. The configuration files and Unlang are extensively documented.
If you want to define local attributes, then read raddb/dictionary, and follow the instructions there.
Alan DeKok.
-- "The foregoing electronic message and any files transmitted with it are confidential and are intended only for the use of the intended recipient named above. This communication may contain material protected by the Family Educational Rights and Privacy Act (FERPA). If you are not the intended recipient, copying, distribution or use of the contents of this message is strictly prohibited. If you received this electronic message in error, please notify us immediately at (228-864-1146**)."**
On Apr 10, 2025, at 2:20 PM, Wayne Sprouse via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I had created the attribute email_domain as a string field in the dictionary file before sending this help request.
Then say that.
I read numerous discussions online regarding using an email address to determine which domain to authenticate against. I was not "just inventing things and expecting them to work" but using examples others shared that worked for them.
No. What you posted was:
if ("%{User-Name}" =~ /@(.+)$/) { # Extract domain from email and store in email_domain set email_domain = "%{1}"
NOTHING in the documentation or examples says you can do: set email_domain = ... If other people say it worked for them, then they're not telling the truth. Again, you can't invent syntax. Using "set email_domain" is inventing syntax. Please stop arguing, and fix the configuration so that it matches the examples and documentation. This means the configuration does NOT use the word "set", and DOES use an "update" section. Alan DeKok.
I am not trying to argue with you, I was explaining how I came about that code. I will update the configuration to "update" and try getting everything to work. I did not think about saying I had already put that attribute into the dictionary already when I posted my topic, I do apologize for that I should have stated everything I had done already. I do appreciate your time. Wayne Sprouse -- "The foregoing electronic message and any files transmitted with it are confidential and are intended only for the use of the intended recipient named above. This communication may contain material protected by the Family Educational Rights and Privacy Act (FERPA). If you are not the intended recipient, copying, distribution or use of the contents of this message is strictly prohibited. If you received this electronic message in error, please notify us immediately at (228-864-1146**)."**
On Apr 10, 2025, at 4:58 PM, Wayne Sprouse via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I am not trying to argue with you, I was explaining how I came about that code.
When you get told that the configuration is wrong, the correct approach is to fix it. When you say "But some random person on the net told met his works", that is arguing. Who is likely to know more? Some random person who wrote a blog post or email 5 years ago, or the FreeRADIUS developers? If it's the FreeRADIUS developers, then why would you waste your time pointing out that your'e following instructions from some random person, which clearly don't work? Don't argue. Do read the documentation. Do follow instructions. Alan DeKok.
participants (2)
-
Alan DeKok -
Wayne Sprouse