How to add VAP based on LDAP group membership
Hi I have a RADIUS setup (eduroam) where the users are authenticated against LDAP (mod_ldap, not ntlm_auth) for our own domain. All other users are proxied to a RadSec proxy. This works fine, but now we need the possibility to replace the Aruba-User-VLAN VAP with a different VLAN ID, if some users from our domain can be found in a special LDAP group (i.e. cn=testgroup). If not, the users should get assigned the Aruba-User-VLAN VAP 31. What do i have to change in my setup in order to make this work? In my /etc/raddb/sites-enabled/testsite i have: ... post-auth { #reply_log #redundant_ldap #exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on #update control { # Tmp-String-0 = "%{debug:2}" #} if (Realm == "testdomain.de") { update reply { Aruba-User-Vlan = "31" } } } Best, Thomas ... -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
On Jan 14, 2016, at 10:04 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I have a RADIUS setup (eduroam) where the users are authenticated against LDAP (mod_ldap, not ntlm_auth) for our own domain. All other users are proxied to a RadSec proxy. This works fine, but now we need the possibility to replace the Aruba-User-VLAN VAP with a different VLAN ID, if some users from our domain can be found in a special LDAP group (i.e. cn=testgroup). If not, the users should get assigned the Aruba-User-VLAN VAP 31.
What do i have to change in my setup in order to make this work?
Write down the rules in procedural form. Then translate them to unlang. if (my realm) { if (ldap group == test group ) { VLAN VAP 31 } else { VLAN VAP } } It's really that simple. Alan DeKok.
Hello To be more specific i want to achieve this: if (Realm == "testdomain.de") { if (calling-station-id -> found in ldap *){ update reply { Aruba-User-Vlan = "31" } else update reply { Aruba-User-Vlan = "32" } } * the mac-address can be found in the ou:hosts with the attribute name "macAddress". The format is aa:bb:cc:dd:ee:ff so the calling-station-id needs to be converted somehow. What i am looking for is the unlang part of the "calling-station-id -> found in ldap" query. Best, Thomas Am 14.01.2016 um 16:25 schrieb Alan DeKok:
On Jan 14, 2016, at 10:04 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I have a RADIUS setup (eduroam) where the users are authenticated against LDAP (mod_ldap, not ntlm_auth) for our own domain. All other users are proxied to a RadSec proxy. This works fine, but now we need the possibility to replace the Aruba-User-VLAN VAP with a different VLAN ID, if some users from our domain can be found in a special LDAP group (i.e. cn=testgroup). If not, the users should get assigned the Aruba-User-VLAN VAP 31.
What do i have to change in my setup in order to make this work? Write down the rules in procedural form. Then translate them to unlang.
if (my realm) { if (ldap group == test group ) { VLAN VAP 31 } else { VLAN VAP } }
It's really that simple.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
You can always use ldap xlat http://wiki.freeradius.org/modules/rlm_ldap BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 20 Jan 2016, 19:42 +0530, Thomas Stather<Thomas.Stather@mpimf-heidelberg.mpg.de>, wrote:
Hello
To be more specific i want to achieve this:
if (Realm == "testdomain.de") {
if (calling-station-id ->found in ldap *){ update reply { Aruba-User-Vlan = "31" } else update reply { Aruba-User-Vlan = "32" } }
* the mac-address can be found in the ou:hosts with the attribute name "macAddress". The format is aa:bb:cc:dd:ee:ff so the calling-station-id needs to be converted somehow.
What i am looking for is the unlang part of the "calling-station-id - found in ldap" query.
Best,
Thomas
Am 14.01.2016 um 16:25 schrieb Alan DeKok:
On Jan 14, 2016, at 10:04 AM, Thomas Stather<Thomas.Stather@mpimf-heidelberg.mpg.de>wrote:
I have a RADIUS setup (eduroam) where the users are authenticated against LDAP (mod_ldap, not ntlm_auth) for our own domain. All other users are proxied to a RadSec proxy. This works fine, but now we need the possibility to replace the Aruba-User-VLAN VAP with a different VLAN ID, if some users from our domain can be found in a special LDAP group (i.e. cn=testgroup). If not, the users should get assigned the Aruba-User-VLAN VAP 31.
What do i have to change in my setup in order to make this work? Write down the rules in procedural form. Then translate them to unlang.
if (my realm) { if (ldap group == test group ) { VLAN VAP 31 } else { VLAN VAP } }
It's really that simple.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services
Tel: +49 6221-486 628 Fax: +49 6221-486 561
------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jan 20, 2016, at 9:11 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Hello
To be more specific i want to achieve this:
if (Realm == "testdomain.de") {
if (calling-station-id -> found in ldap *){
Use: if ("%{ldap:....}") { Write an LDAP query which looks up the calling-station ID, and returns something. Then, put the LDAP query into the line above. Alan DeKok.
Hello Ok which one of the following 2 statement is correct: if ("%{ldap:///ou=hosts,dc=my-company,dc=de?macAddress?sub?macAddress=%u}" =%{Calling-Station-Id}) { ... } if ("%{ldap:///ou=hosts,dc=my-company,dc=de?macAdress?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") { ... } Best, Thomas Am 20.01.2016 um 15:31 schrieb Alan DeKok:
On Jan 20, 2016, at 9:11 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Hello
To be more specific i want to achieve this:
if (Realm == "testdomain.de") {
if (calling-station-id -> found in ldap *){ Use:
if ("%{ldap:....}") {
Write an LDAP query which looks up the calling-station ID, and returns something. Then, put the LDAP query into the line above.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
None if ("%{ldap:///ou=hosts,dc=my-company,dc=de?macAddress?sub?uid=%u}" =%{Calling-Station-Id}) { ... } This should work. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 20 Jan 2016, 20:17 +0530, Thomas Stather<Thomas.Stather@mpimf-heidelberg.mpg.de>, wrote:
Hello
Ok which one of the following 2 statement is correct:
if ("%{ldap:///ou=hosts,dc=my-company,dc=de?macAddress?sub?macAddress=%u}" =%{Calling-Station-Id}) { ... }
if ("%{ldap:///ou=hosts,dc=my-company,dc=de?macAdress?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") { ... }
Best,
Thomas
Am 20.01.2016 um 15:31 schrieb Alan DeKok:
On Jan 20, 2016, at 9:11 AM, Thomas Stather<Thomas.Stather@mpimf-heidelberg.mpg.de>wrote:
Hello
To be more specific i want to achieve this:
if (Realm == "testdomain.de") {
if (calling-station-id ->found in ldap *){ Use:
if ("%{ldap:....}") {
Write an LDAP query which looks up the calling-station ID, and returns something. Then, put the LDAP query into the line above.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services
Tel: +49 6221-486 628 Fax: +49 6221-486 561
------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jan 20, 2016, at 9:47 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Ok which one of the following 2 statement is correct:
Both might work if you fix the syntax. But I suggest *trying* it. I don't have access to your LDAP database or schema, so I can only offer general help. Alan DeKok.
Hi It still doesn't work I tried this in "post-auth" section: if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { update reply { Aruba-User-Vlan = "200" } } debug output is: (12) post-auth { (12) if (Realm == "testdomain.de") { (12) if (Realm == "testdomain.de") -> TRUE (12) if (Realm == "testdomain.de") { (12) if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { (12) ERROR: String passed does not look like an LDAP URL (12) ERROR: String passed does not look like an LDAP URL (12) EXPAND %{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub} (12) --> (12) if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) -> FALSE (12) else { (12) update reply { (12) Aruba-User-Vlan = 110 (12) } # update reply = noop (12) } # else = noop (12) } # if (Realm == "testdomain.de") = noop (12) ... skipping else for request 12: Preceding "if" was taken (12) } # post-auth = noop What am i doing wrong? Like i said i want the "hosts" section (containing all hosts) to be searched for the mac address of the connecting client. A entry in our LDAP "hosts" section looks like this: cn laptop-test cn laptop-test.testdomain.de description Testlaptop ipHostNumber 192.168.1.100 macAddress 11:22:33:44:55:66 objectClass top objectClass ipHost objectClass ieee802Device Best, Thomas Am 20.01.2016 um 16:53 schrieb Alan DeKok:
On Jan 20, 2016, at 9:47 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Ok which one of the following 2 statement is correct: Both might work if you fix the syntax.
But I suggest *trying* it. I don't have access to your LDAP database or schema, so I can only offer general help.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
On Feb 19, 2016, at 6:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I tried this in "post-auth" section:
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) {
That isn't an LDAP URL.
(12) if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { (12) ERROR: String passed does not look like an LDAP URL (12) ERROR: String passed does not look like an LDAP URL
Yup. The LDAP client code doesn't think it's an LDAP URL.
What am i doing wrong?
You're not passing an LDAP URL to the LDAP query. I would have thought the message was pretty clear. Read the LDAP documentation to see what an LDAP URL looks like. A simple google search for "ldap url" yields lots of documentation. All of which says you need a hostname. Alan DeKok.
Hi I still don't get it sorry :( I tried if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") { update reply { Aruba-User-Vlan = "200" } } But the error message is the same. What do you mean with "all needs a hostname"? The "redundand_ldap" is configured as: redundant redundant_ldap { ldap1 ldap2 } Best, Thomas Am 19.02.2016 um 13:14 schrieb Alan DeKok:
On Feb 19, 2016, at 6:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I tried this in "post-auth" section:
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { That isn't an LDAP URL. (12) if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { (12) ERROR: String passed does not look like an LDAP URL (12) ERROR: String passed does not look like an LDAP URL Yup. The LDAP client code doesn't think it's an LDAP URL.
What am i doing wrong? You're not passing an LDAP URL to the LDAP query. I would have thought the message was pretty clear.
Read the LDAP documentation to see what an LDAP URL looks like. A simple google search for "ldap url" yields lots of documentation.
All of which says you need a hostname.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
Hi,
I still don't get it sorry :(
ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}
There is no hostname in that string. Which server do you want to ask? You should tell the server that tiny bit of information. In most protocols, the hostname comes after the first two slashes, like in ldap://hostname.example/... The first hit for "ldap url" on DuckDuckGo brought to this page: http://docs.oracle.com/javase/jndi/tutorial/ldap/misc/url.html and I'm sure there are hundreds of pages on the net with that same information. Greetings, Stefan Winter
{ update reply { Aruba-User-Vlan = "200" } }
But the error message is the same. What do you mean with "all needs a hostname"? The "redundand_ldap" is configured as:
redundant redundant_ldap { ldap1 ldap2 }
Best, Thomas
Am 19.02.2016 um 13:14 schrieb Alan DeKok:
On Feb 19, 2016, at 6:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I tried this in "post-auth" section:
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { That isn't an LDAP URL. (12) if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub}" == %{Calling-Station-Id}) { (12) ERROR: String passed does not look like an LDAP URL (12) ERROR: String passed does not look like an LDAP URL Yup. The LDAP client code doesn't think it's an LDAP URL.
What am i doing wrong? You're not passing an LDAP URL to the LDAP query. I would have thought the message was pretty clear.
Read the LDAP documentation to see what an LDAP URL looks like. A simple google search for "ldap url" yields lots of documentation.
All of which says you need a hostname.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
Stefan Winter wrote:
I still don't get it sorry :(
ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}
There is no hostname in that string. Which server do you want to ask? You should tell the server that tiny bit of information.
Maybe there is some confusion because some LDAP (client) software allow to specify search parameters for an already existing LDAP connection as LDAP URLs without hostport part. It entirely depends on the client implementation whether that has any meaning or not. (I cannot comment on the FreeRADIUS internals.) Ciao, Michael.
On Feb 19, 2016, at 7:45 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I tried
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") {
As another example: grep -r ldap:// raddb/ raddb//sites-available/dynamic-clients: if ("%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}") { raddb//sites-available/dynamic-clients: &FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}" raddb//sites-available/dynamic-clients: &FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}" Alan DeKok.
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") { update reply { Aruba-User-Vlan = "200" } }
Try: if ("%{redundant_ldap:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") { : : } Your original statement just refers to the ldap module, so it's seen as 'feed "///ou=hosts,..." to redundant_ldap', not 'feed "ldap:///ou=hosts,..." to redundant_ldap'. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
Hi Thanks a lot Stefan Paetow and Michael Ströder for pointing me in the right direction :) Now i have another (but hopefully not difficult to solve) problem. I get "Search returned no results" ouput which is obvious, since the mac-address VAP (after "rewrite-calling-station-id") has the format: AA-BB-CC-DD-EE-FF but on the ldap-server, the format is aa:bb:cc:dd:ee:ff How can i rewrite the mac address only for this ldap query (and not globally)? I hope then it will work in my case. Best, Thomas Am 22.02.2016 um 10:25 schrieb Stefan Paetow:
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") { update reply { Aruba-User-Vlan = "200" } } Try:
if ("%{redundant_ldap:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") { : : }
Your original statement just refers to the ldap module, so it's seen as 'feed "///ou=hosts,..." to redundant_ldap', not 'feed "ldap:///ou=hosts,..." to redundant_ldap'.
:-)
Stefan Paetow Moonshot Industry & Research Liaison Coordinator
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet
jisc.ac.uk
Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
Hi I wrote a snippet in policy.d to create a VAP i can then use for the LDAP query: mac-addr-regexp = '([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})' # add a VAP "LDAP-MacAddress" to be used for ldap query # Calling-Station-Id has already been normalized by the "rewrite-calling-station-id" function add-mac-ldap { if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) { update control { LDAP-MacAddress := "%{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}" } updated } else { noop } } And then addid this VAP into the dictionary: ATTRIBUTE LDAP-MacAddress 3000 string The LDAP query that i use is: if ("%{ldap1:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{LDAP-MacAddress}}") { ... } but its still not working. The log shows: (53) post-auth { (53) policy add-mac-ldap { (53) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (53) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (53) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (53) update control { (53) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} (53) --> a4:34:d9:22:da:5d (53) LDAP-MacAddress := a4:34:d9:22:da:5d (53) } # update control = noop (53) [updated] = updated (53) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (53) ... skipping else for request 53: Preceding "if" was taken (53) } # policy add-mac-ldap = updated (53) if (Realm == "testdomain.de") { (53) if (Realm == "testdomain.de") -> TRUE (53) if (Realm == "testdomain.de") { (53) if ("%{ldap1:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{LDAP-MacAddress}}") { rlm_ldap (ldap1): Reserved connection (8) (53) Performing search in "ou=hosts,dc=testdomain,dc=de" with filter "macAddress=", scope "sub" (53) Waiting for search result... (53) Search returned no results rlm_ldap (ldap1): Released connection (8) (53) EXPAND %{ldap1:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{LDAP-MacAddress}} (53) --> (53) if ("%{ldap1:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{LDAP-MacAddress}}") -> FALSE (53) else { (53) update reply { (53) Aruba-User-Vlan = 500 (53) } # update reply = noop (53) } # else = noop (53) } # if (Realm == "testdomain.de") = noop (53) ... skipping else for request 53: Preceding "if" was taken (53) } # post-auth = updated What am i doing wrong? Best, Thomas Am 22.02.16 12:01 nachm. schrieb Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de>:
Hi
Thanks a lot Stefan Paetow and Michael Ströder for pointing me in the right direction :) Now i have another (but hopefully not difficult to solve) problem.
I get "Search returned no results" ouput which is obvious, since the mac-address VAP (after "rewrite-calling-station-id") has the format:
AA-BB-CC-DD-EE-FF
but on the ldap-server, the format is
aa:bb:cc:dd:ee:ff
How can i rewrite the mac address only for this ldap query (and not globally)? I hope then it will work in my case.
Best,
Thomas
Am 22.02.2016 um 10:25 schrieb Stefan Paetow:
if ("%{redundant_ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") { update reply { Aruba-User-Vlan = "200" }}
Try:if ("%{redundant_ldap:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{Calling-Station-Id}}") {::}Your original statement just refers to the ldap module, so it's seen as 'feed "///ou=hosts,..." to redundant_ldap', not 'feed "ldap:///ou=hosts,..."(ldap:///ou=hosts,...) to redundant_ldap'.:-)Stefan PaetowMoonshot Industry & Research Liaison Coordinatort: +44 (0)1235 822 125gpg: 0x3FCE5142xmpp: stefanp@jabber.dev.ja.net(javascript:main.compose()skype: stefan.paetow.janetjisc.ac.ukNetworkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas StatherIT ServicesTel: +49 6221-486 628Fax: +49 6221-486 561------------------------------------------------------------------------Max Planck Institute for Medical Research (MPImF)Jahnstrasse 29, 69120 HeidelbergGermany
On Feb 22, 2016, at 8:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote: ...
if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) { update control {
Note: control.
(53) if ("%{ldap1:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{LDAP-MacAddress}}") {
Note: no "control".
rlm_ldap (ldap1): Reserved connection (8) (53) Performing search in "ou=hosts,dc=testdomain,dc=de" with filter "macAddress=", scope "sub"
As expected, there's no LDAP-MacAddress. There *is* a control:LDAP-MacAddress.
(53) Waiting for search result... (53) Search returned no results
As expected. Alan DeKok.
Hi Thanks a lot, now it works!!! Best, Thomas Am 22.02.2016 um 14:28 schrieb Alan DeKok:
On Feb 22, 2016, at 8:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote: ...
if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) { update control { Note: control. (53) if ("%{ldap1:ldap:///ou=hosts,dc=testdomain,dc=de?macAddress?sub?macAddress=%{LDAP-MacAddress}}") { Note: no "control".
rlm_ldap (ldap1): Reserved connection (8) (53) Performing search in "ou=hosts,dc=testdomain,dc=de" with filter "macAddress=", scope "sub" As expected, there's no LDAP-MacAddress. There *is* a control:LDAP-MacAddress.
(53) Waiting for search result... (53) Search returned no results As expected.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
participants (6)
-
Alan DeKok -
Anirudh Malhotra -
Michael Ströder -
Stefan Paetow -
Stefan Winter -
Thomas Stather