External shell script return value for inner-tunnel
Hello, We have been using FreeRadius for a long time and now we are in the process of doing dynamic vlan assignments for EAP clients based on a custom AD attribute "persontype". I created a new module called bowdpersontype which does a LDAP search for the user to pull their persontype attribute, then placed this under eap in the inner tunnel. Testing vlan assignment works here, however I want to base their vlan on what their attribute is, for example staff, faculty, admin. This part is easy, however I'm not sure on how I use the value returned in the external script. My module looks like this:- --- exec bowdpersontype { wait = yes output_pairs = reply shell_escape = yes program = "/etc/freeradius/testldap.sh %{Stripped-User-Name}" } --- This test script will output:- echo "UserType=$bowdpersontype" And the inner tunnel:- --- bowdpersontype if (UserType =~ /STAFF/) { update reply { ..... ..... } } --- The debug output does show me the result from the external script and 'ok' message. How do I read the value to be used after the call? Cheers, - Trevor
On Aug 23, 2019, at 8:27 PM, Trevor Jennings <tjennings@gmail.com> wrote:
My module looks like this:- --- exec bowdpersontype { wait = yes output_pairs = reply shell_escape = yes program = "/etc/freeradius/testldap.sh %{Stripped-User-Name}" } ---
This test script will output:-
echo "UserType=$bowdpersontype"
What is the "UserType" attribute? Where is it defined?
And the inner tunnel:-
--- bowdpersontype
if (UserType =~ /STAFF/) {
See "man unlang". That is looking in the *request* list. The "exec" module configuration is putting the attribute into the *reply* list.
update reply { ..... ..... } } ---
The debug output does show me the result from the external script and 'ok' message. How do I read the value to be used after the call?
If you return a known attribute, *and* reference it in the right list, it will just work. Alan DeKok.
Hi Alan, Thanks for pointing me in the right direction. This now works! I had to basically assign "UserType" as an attribute in the dictionary and reference this as reply:UserType in the inner tunnel. Cheers, - Trevor On Sat, Aug 24, 2019 at 9:22 AM Alan DeKok <aland@deployingradius.com> wrote:
On Aug 23, 2019, at 8:27 PM, Trevor Jennings <tjennings@gmail.com> wrote:
My module looks like this:- --- exec bowdpersontype { wait = yes output_pairs = reply shell_escape = yes program = "/etc/freeradius/testldap.sh %{Stripped-User-Name}" } ---
This test script will output:-
echo "UserType=$bowdpersontype"
What is the "UserType" attribute? Where is it defined?
And the inner tunnel:-
--- bowdpersontype
if (UserType =~ /STAFF/) {
See "man unlang". That is looking in the *request* list. The "exec" module configuration is putting the attribute into the *reply* list.
update reply { ..... ..... } } ---
The debug output does show me the result from the external script and
'ok'
message. How do I read the value to be used after the call?
If you return a known attribute, *and* reference it in the right list, it will just work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Trevor Jennings -
Trevor Jennings