Hey guys/gals, I'm a newbite with freeradius and have come upon an interesting issue. Here at my job we've been using Radiator-ODBC for quite some time and are hoping to phase this out and begin using freeradius, along with some more modern hardware, instead. Here's the issue I'm coming across. The file we were using for authentication is a binary file, and inaccessible to me for use in the new implementation so i've been building my own. The information I can access doesn't have groups available to me, however, they are retrievable. What I've been trying to do is use the file generated from our nis servers for the actual authentication, but a different file, containing only username:group pairs. Right now, I have it set up with an entry for rad_group with the following: passwd rad_group{ filename = /usr/local/etc/raddb/group format="*User-Name:~Group" authtype=System } Then placed rad_group in the authorize section. I get the following output in a debug after doing this: Wed May 3 11:52:21 2006 : Debug: rlm_passwd: Added Group: 'filtered' to request_items But Group = "foo" is completely disregarded and radius simply skips to the last, least restrictive entry in the file. What am I missing? Thanks, Wayne
Wayne Hill <wphill@voicenet.com> wrote:
Right now, I have it set up with an entry for rad_group with the following:
passwd rad_group{ filename = /usr/local/etc/raddb/group format="*User-Name:~Group"
Don't use the "Group" attribute. It's for Unix groups. The rlm_passwd "man" page says to use the "My-Group" attribute for a reason. Alan DeKok.
That did it, but it's brought about some other weirdness. When I replace Group with My-Group in some lines, I now get complaints about an unexpected trailing comma, where there is none. Eg. The following line returns with no error: DEFAULT Auth-Type=System,Group=="filtered",NasType=Aleron But this: DEFAULT Auth-Type=System,My-Group=="filtered",NasType=Aleron Complains of an unexpected trailing comma. Just to be sure my syntax wasn't messed up (since i'm basing this off of a barely compatible file) I've tried with both NasType and Nas- Type (just to be safe) and still get the same error, reproducible between situations. Sorry for my newbishness, this all has just /really/ got me stumped. --Wayne On May 3, 2006, at 1:40 PM, Alan DeKok wrote:
Wayne Hill <wphill@voicenet.com> wrote:
Right now, I have it set up with an entry for rad_group with the following:
passwd rad_group{ filename = /usr/local/etc/raddb/group format="*User-Name:~Group"
Don't use the "Group" attribute. It's for Unix groups.
The rlm_passwd "man" page says to use the "My-Group" attribute for a reason.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
Wayne Hill <wphill@voicenet.com> wrote:
But this: DEFAULT Auth-Type=System,My-Group=="filtered",NasType=Aleron
Complains of an unexpected trailing comma.
Yeah, the parser is a little dumb. It should be a bit better in 1.1.2. The solution is to list "My-group" as an attribute in the dictionary. See raddb/dictionary for examples of how to create an attribute, and "man dictionary" for more information. Alan DeKok.
participants (2)
-
Alan DeKok -
Wayne Hill