[LDAP] User-Profile assigned only if set in user attr radiusProfileDn
greetings, FR 3.0.x git 180e0b27022237a5f75c3c25d7eb1dbded634bad am I correct to expect User-Profile assigned if user belongs to Ldap-Group? here is how I supposed to get it working: ---[ file `users' quotation start ]------------------------------------------- ... DEFAULT Ldap-Group == "wifi-ABC", Called-Station-SSID == "ABC", Login-Time := 'Al0700-2200', User-Profile := "cn=wifi-ABC,ou=profiles,ou=RADIUS,dc=xyz" Reply-Message := "User-Profile is %{control:User-Profile}", Fall-Through = no ... ---[ file `users' quotation end ]------------------------------------------- here is what I have in debug: ---[ debug quotation start ]------------------------------------------- ... (6) files: Searching for user in group "wifi-ABC" ... (6) files: User found in group object "ou=groups,ou=RADIUS,dc=xyz" rlm_ldap (ldap): Released connection (9) (6) files: users: Matched entry DEFAULT at line 95 (6) files: EXPAND User-Profile is %{control:User-Profile} (6) files: --> User-Profile is (6) [files] = ok rlm_ldap (ldap): Reserved connection (10) ... (6) ldap: User object found at DN "uid=rad-jdoe,authorizedService=802.1x-eap-tls@xyz,uid=jdoe,ou=People,dc=xyz" (6) ldap: Waiting for search result... (6) ldap: Processing user attributes (6) ldap: control:Cleartext-Password := '********' (6) ldap: control:Password-With-Header += '********' r_ldap (ldap): Released connection (326) (6) [ldap] = updated ... ---[ debug quotation end ]------------------------------------------- no evidence, profile attributes were searched/processed ... my user is found to be a part of Ldap-Group, how to know why User-Profile is not assigned? in documentation it is written: if user is a part of Ldap-Group, the User-Profile will be assigned to the user. the only way, I found, to get User-Profile assigned to user is to set attribute radiusProfileDn value in user object directly ... but this causes one-user-one-profile result, what is not the resul I hoped for where are am I mistaking? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
On Aug 15, 2015, at 10:34 AM, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
greetings,
FR 3.0.x git 180e0b27022237a5f75c3c25d7eb1dbded634bad
am I correct to expect User-Profile assigned if user belongs to Ldap-Group?
No. Read the documentation http://wiki.freeradius.org/modules/Rlm_ldap
my user is found to be a part of Ldap-Group, how to know why User-Profile is not assigned?
Because it doesn't assign User-Profile when doing LDAP group checks.
in documentation it is written: if user is a part of Ldap-Group, the User-Profile will be assigned to the user.
What documentation says that? Alan DeKok.
Alan DeKok <aland@deployingradius.com> wrote:
User-Profile is not assigned?
Because it doesn't assign User-Profile when doing LDAP group checks.
so, am I wrong to expect User-Profile assignment in case the user is the member of Ldap_Group, when `users' file contains that DEFAULT definition? DEFAULT Ldap-Group == ..., User-Profile := ... or, is it the only way to get User-Profile assigned according the Ldap-Group membership, to: post-auth { if (LDAP-Group == "LDAP Group One") { User-Profile := "cn=userprofile1,ou=profiles,ou=RADIUS,dc=xyz" } } then how is it correct to assign the profile? is syntax above correct?
in documentation it is written: if user is a part of Ldap-Group, the User-Profile will be assigned to the user.
What documentation says that?
FreeRADIUS Beginner's Guide by Dirk van der Walt, Published by Packt Publishing Ltd in 2011 p.113 heading "Ldap-Group and User-Profile AVP" ---[ quotation start ]------------------------------------------- ... Ldap-Group and User-Profile are usually paired together. First an LDAP search is done to check if a user is part of an Ldap-Group. If true, the specified User-Profile is assigned. If not true, the specified User-Profile is not assigned. Let's make use of it: 1. Edit the users file and add the following to the bottom: ... DEFAULT Ldap-Group == teachers, User-Profile := "cn=teachers,ou =profiles,ou=radius,dc=my-domain,dc=com" Fall-Through = no ... Let's look at some important points: ... * If the user is part of the Ldap-Group, the User-Profile will be assigned to the user. A User-Profile specified as a DN causes the ldap module to search for the DN during authorization: [ldap] performing search in cn=teachers,ou=profiles,ou=radius,d c=my-domain,dc=com, with filter (objectclass=radiusprofile) ... ---[ quotation end ]------------------------------------------- -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
On 16 Aug 2015, at 11:44, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
Alan DeKok <aland@deployingradius.com> wrote:
User-Profile is not assigned?
Because it doesn't assign User-Profile when doing LDAP group checks.
so, am I wrong to expect User-Profile assignment in case the user is the member of Ldap_Group, when `users' file contains that DEFAULT definition?
DEFAULT Ldap-Group == ..., User-Profile := ...
or, is it the only way to get User-Profile assigned according the Ldap-Group membership, to:
post-auth { if (LDAP-Group == "LDAP Group One") { User-Profile := "cn=userprofile1,ou=profiles,ou=RADIUS,dc=xyz" } }
then how is it correct to assign the profile? is syntax above correct?
That documentation wasn't updated for v3.0.x unfortunately. user.default is a polymorphic config item in v3.0.x, meaning it can be an attribute reference a literal string or an exec. If you wanted to use it you'd set user.default to &control:User-Profile, e.g. ldap { user { default = &control:User-Profile } } And set the profile in the users file, just as you appear to be trying to do. It may be that the users file is updating the request atomically, so that both control and reply items get added in such a way that one cannot reference the other, which is why your expansion %{control:LDAP-Profile} appears to be an empty string. I'd try listing debug_control after calling the users file and seeing if the value for User-Profile appears there. authorize { files debug_control ldap } If debug_control doesn't exist add the following to raddb/policy.conf # # Outputs the contents of the control list in debugging (-X) mode # debug_control { if("%{debug_attr:control:}" == '') { noop } } -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
then how is it correct to assign the profile? is syntax above correct?
That documentation wasn't updated for v3.0.x unfortunately.
thank you, Arran, for pointing that
If you wanted to use it you'd
I do know what I want, I have no any idea *how* to achieve that with FR :( I used users file only because I didn't find anything other ... I need to assign User-Profile ABC to each user who belongs to Ldap-Group ABC not the default profile for all users but only for ones who belongs to the group in the doc qoted in my previous post it is rather clear that it works via file users ... because of that I used namely that way ...
I'd try listing debug_control after calling the users file and seeing if the value for User-Profile appears there.
here it is: ---[ debug quotation start ]------------------------------------------- ... (7) files: Searching for user in group "wifi-abc" ... (7) files: User found in group object "ou=groups,ou=RADIUS,dc=xyz" rlm_ldap (ldap): Released connection (1) (7) files: users: Matched entry DEFAULT at line 78 (7) files: EXPAND %{User-Name}, SSID: %{Called-Station-SSID} access was permited and %{control:User-Profile} was assigned to you. (7) files: --> rad-visitor, SSID: ABC access was permited and was assigned to you. (7) [files] = ok (7) policy debug_control { (7) if ("%{debug_attr:control:}" == '') { (7) Attributes matching "control:" (7) &control:LDAP-UserDN = uid=rad-visitor,authorizedService=802.1x-eap-tls@xyz,uid=jdoe,ou=People,dc=xyz (7) &control:User-Profile := cn=wifi-abc,ou=profiles,ou=RADIUS,dc=xyz (7) EXPAND %{debug_attr:control:} (7) --> (7) if ("%{debug_attr:control:}" == '') -> TRUE (7) if ("%{debug_attr:control:}" == '') { (7) [noop] = noop (7) } # if ("%{debug_attr:control:}" == '') = noop (7) } # policy debug_control = noop rlm_ldap (ldap): Reserved connection (2) ... (7) ldap: Waiting for search result... (7) ldap: User object found at DN "uid=rad-visitor,authorizedService=802.1x-eap-tls@xyz,uid=jdoe,ou=People,dc=xyz" (7) ldap: Processing user attributes (7) ldap: control:Cleartext-Password := 'rad-visitor' (7) ldap: control:Password-With-Header += 'rad-visitor' rlm_ldap (ldap): Released connection (2) (7) [ldap] = updated ... ---[ debug quotation end ]------------------------------------------- so, at least it is there ... but still not assigned in file users I have this: ---[ file users quotation start ]------------------------------------------- ... DEFAULT Ldap-Group == "wifi-abc", Called-Station-SSID == "ABC", User-Profile := "cn=wifi-abc,ou=profiles,ou=RADIUS,dc=xyz" Fall-Through = no ... ---[ file users quotation end ]------------------------------------------- -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
so, at least it is there ... but still not assigned
OK, great, so we know the users file is working as it should. Did you edit mods-available/ldap to set the source for the LDAP profile as I showed in my previous mail? ldap { ... user { ... default = &control:User-Profile } } -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Did you edit mods-available/ldap to set the source for the LDAP profile as I showed in my previous mail?
ldap { ... user { ...
default = &control:User-Profile } }
no, I didn't yet ... since I need not the single, default profile for all users but definite profile for users who are members of some definite group I believe I need not default= but some condition check and assignment on it's result ... something like: if ( Ldap-Group == 'ABC' ) { if ( Called-Station-SSID ) { if ( Called-Station-SSID == 'ABC' ) { update { User-Profile := "cn=ABC,ou=profiles,ou=RADIUS,dc=xyz" } } } } but which module I have to say what (and how), to make FR to assign it? I'm giving up :( -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
On Aug 16, 2015, at 5:44 PM, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
so, am I wrong to expect User-Profile assignment in case the user is the member of Ldap_Group, when `users' file contains that DEFAULT definition?
DEFAULT Ldap-Group == ..., User-Profile := ...
Yes, that should work. But what you are missing is that assigning User-Profile in the "users" file assigns it to the *request* list. Not the *control* list.
or, is it the only way to get User-Profile assigned according the Ldap-Group membership, to:
post-auth { if (LDAP-Group == "LDAP Group One") { User-Profile := "cn=userprofile1,ou=profiles,ou=RADIUS,dc=xyz"
And that isn't a valid statement. You need an "update" statement.
then how is it correct to assign the profile?
You assigned it like any other attribute. Starting off by reading the documentation, and using the correct syntax.
FreeRADIUS Beginner's Guide by Dirk van der Walt, Published by Packt Publishing Ltd in 2011 p.113 heading "Ldap-Group and User-Profile AVP"
Well... we didn't write that.
---[ quotation start ]------------------------------------------- ... Ldap-Group and User-Profile are usually paired together. First an LDAP search is done to check if a user is part of an Ldap-Group. If true, the specified User-Profile is assigned. If not true, the specified User-Profile is not assigned.
That's done when the "ldap" module is run in the "authorize" stage. It is NOT done when you manually tell the server to do an LDAP-Group check. Alan DeKok.
Alan DeKok <aland@deployingradius.com> wrote:
assigned. If not true, the specified User-Profile is not assigned.
That's done when the "ldap" module is run in the "authorize" stage. It is NOT done when you manually tell the server to do an LDAP-Group check.
where are the conditions for that check should then be defined? I hoped to set: radiusCheckItem='Called-Station-SSID == ABC' radiusReplyItem='User-Profile=cn=userprofile1,ou=profiles,ou=RADIUS,dc=xyz' in user's LDAP object, but it doesn't work ... and if I understood your some previous answer, it is not supposed to work this way (at least now) please, help me to understand what I miss ... it looks as simple and not so rare condition ... "to assign LDAP based profile to the user who belongs to LDAP based group" if it is impossible to do via only-LDAP configuration, than how to do it correct way? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
On 16 Aug 2015, at 13:31, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
Alan DeKok <aland@deployingradius.com> wrote:
assigned. If not true, the specified User-Profile is not assigned.
That's done when the "ldap" module is run in the "authorize" stage. It is NOT done when you manually tell the server to do an LDAP-Group check.
where are the conditions for that check should then be defined?
I hoped to set:
radiusCheckItem='Called-Station-SSID == ABC' radiusReplyItem='User-Profile=cn=userprofile1,ou=profiles,ou=RADIUS,dc=xyz'
in user's LDAP object, but it doesn't work ... and if I understood your some previous answer, it is not supposed to work this way (at least now)
Ah, they got moved. So the one you want for using a RADIUS attribute is this one: https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail... And the one you want for using an LDAP attribute is this one: https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail... -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
So the one you want for using a RADIUS attribute is this one:
https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail...
no, it is not the one I want not the default profile but the way to assign definite one to the user belonging to some definite group
And the one you want for using an LDAP attribute is this one:
https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail...
yes, it works fine until I need special profile for special condition, otherwise it is one-user-one-profile solution :( -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
On 16 Aug 2015, at 14:55, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
So the one you want for using a RADIUS attribute is this one:
https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail...
no, it is not the one
I want not the default profile but the way to assign definite one to the user belonging to some definite group
I'm starting to understand why Alan gets annoyed with list users. I wrote a good portion of that code. I know EXACTLY how it works. You did not write the code, you have no idea how it works, yet you're saying my advice is incorrect, and you're basing this on a bad mental model of how the server works, created from outdated documentation. Great. Edit mods-available/ldap Set default like this: ldap { ... profile { ... default = &control:User-Profile } } Edit sites-available/default Call the modules in authorize in this order: authorize { files debug_control ldap } It will work, it will do what you want. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
I wrote a good portion of that code. I know EXACTLY how it works. You did not write the code, you have no idea how it works, yet you're saying my advice is incorrect, and you're basing this on a bad mental model of how the server works, created from outdated documentation. Great.
yes Arran, you are right and definitely it is not my intention to annoy (anybody) but you are the only one who helped with this question in my git v.3.0.x, the commentary in ldap module config file for profile section, option default says: # The default profile applied to all users. I'll be honest, I'd never mind to think of it at all (because I need not "default for all") and was sure it is not the one I need I'm sorry for your time but it helped! It works just as you told, thank you again! -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Zeus Panchenko