Conditional modules and dynamically attributes
Hi everyone! I have freeradius 3.0.20 and use rlm_ldap as a conditional module in the authorize section like this authorize { ... sql if (notfound) { -ldap if (&LDAP-Group == '% {Group-Name}') { update { &control:Auth-Type: = ldap } } else { ... } } ... } I enable and disable (if it is not configured) module by creating/deleting a link in the mods-enabled/ directory, but when the module is disabled, I cannot use the attribute LDAP-Group in the condition because it loads dynamically when the module loads. I found this issue https://github.com/FreeRADIUS/freeradius-server/issues/1642 but it says nothing if a conditional module is used. How can I use dynamically loads attributes such as LDAP-Group or SQL-Group and conditional modules? -- Viktor
On Sep 11, 2019, at 4:06 PM, Viktor Kolesnikov <vvkolesnikoff@gmail.com> wrote:
I have freeradius 3.0.20 and use rlm_ldap as a conditional module in the authorize section like this authorize { ... sql if (notfound) { -ldap if (&LDAP-Group == '% {Group-Name}') { update { &control:Auth-Type: = ldap
Ok.
I enable and disable (if it is not configured) module by creating/deleting a link in the mods-enabled/ directory, but when the module is disabled, I cannot use the attribute LDAP-Group in the condition because it loads dynamically when the module loads.
Yes. How do you expect to use LDAP-Group when there's no ldap module? The conditional modules are a simple hack for simple things. If you need complex changes, edit the configuration files.
I found this issue https://github.com/FreeRADIUS/freeradius-server/issues/1642 but it says nothing if a conditional module is used. How can I use dynamically loads attributes such as LDAP-Group or SQL-Group and conditional modules?
Edit the configuration files. Why are you dynamically loading LDAP-Group when you aren't using ldap? You should create a configuration that works. There's no point in creating a configuration that's broken, and then trying to make the server skip portions of it. Alan DeKok.
On Sep 11, 2019, at 23:15 PM Alan DeKok <aland@deployingradius.com> wrote:
Yes. How do you expect to use LDAP-Group when there's no ldap module?
The conditional modules are a simple hack for simple things. If you
need complex changes, edit the configuration files.
I expected this attribute to be ignored if the module is not loaded, the condition will not be met or will be skipped and the check will return a reject.
Edit the configuration files.
Why are you dynamically loading LDAP-Group when you aren't using ldap?
You should create a configuration that works. There's no point in creating a configuration that's broken, and then trying to make the server skip portions of it.
I am trying to create a configuration of virtual server with many access checks combining different modules and i think that enabling/disabling modules by creating a link is easier than editing configuration file in many places.
Maybe checking the condition that the module was loaded would be useful
here, but I have not found a way to do this checking using unlang, and I think that it does not exist.
Sorry for formatting. On Sep 11, 2019, at 23:15 PM Alan DeKok <aland@deployingradius.com> wrote: Yes. How do you expect to use LDAP-Group when there's no ldap module? The conditional modules are a simple hack for simple things. If you need complex changes, edit the configuration files. I expected this attribute to be ignored if the module is not loaded, the condition will not be met or will be skipped and the check will return a reject. Edit the configuration files. Why are you dynamically loading LDAP-Group when you aren't using ldap? You should create a configuration that works. There's no point in creating a configuration that's broken, and then trying to make the server skip portions of it. I am trying to create a configuration of virtual server with many access checks combining different modules and i think that enabling/disabling modules by creating a link is easier than editing configuration file in many places. Maybe checking the condition that the module was loaded would be useful here, but I have not found a way to do this checking using unlang, and I think that it does not exist.
On Sep 11, 2019, at 6:49 PM, Viktor Kolesnikov <vvkolesnikoff@gmail.com> wrote:
I expected this attribute to be ignored if the module is not loaded, the condition will not be met or will be skipped and the check will return a reject.
The documentation doesn't say that happens.
I am trying to create a configuration of virtual server with many access checks combining different modules and i think that enabling/disabling modules by creating a link is easier than editing configuration file in many places.
You can include pieces via $INCLUDE. There's even a $-INCLUDE which includes files only if they exist.
Maybe checking the condition that the module was loaded would be useful here, but I have not found a way to do this checking using unlang, and I think that it does not exist.
See $-INCLUDE. This is documented in "man unlang" Alan DeKok.
Thanks for the tip, Alan. I spent some time of testing, and $-INCLUDE works fine in this case. Including custom configurations to the main virtual server is a very useful tool. чт, 12 сент. 2019 г. в 02:24, Alan DeKok <aland@deployingradius.com>:
On Sep 11, 2019, at 6:49 PM, Viktor Kolesnikov <vvkolesnikoff@gmail.com> wrote:
I expected this attribute to be ignored if the module is not loaded, the condition will not be met or will be skipped and the check will return a reject.
The documentation doesn't say that happens.
I am trying to create a configuration of virtual server with many access checks combining different modules and i think that enabling/disabling modules by creating a link is easier than editing configuration file in many places.
You can include pieces via $INCLUDE. There's even a $-INCLUDE which includes files only if they exist.
Maybe checking the condition that the module was loaded would be useful here, but I have not found a way to do this checking using unlang, and I think that it does not exist.
See $-INCLUDE. This is documented in "man unlang"
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Viktor
participants (2)
-
Alan DeKok -
Viktor Kolesnikov