On Apr 14, 2022, at 10:26 PM, Peter Payne <freeradius20220411@abitry.com.au> wrote:

In the rlm_ldap module configuration file "ldap" there is a configuration parameter in the "user { }" section named "access_attribute". I have that set to "dialupAccess".

I also have the configuration parameter in the "profile { }" section named "attribute" set to "radiusProfileDn".

My users, in LDAP, all have "radiusProfileDn" set to point to a profile, e.g.: radiusProfileDn: cn=adsl,ou=radius profiles,o=myorg

And I'd like to put the "dialupAccess" attribute in the profile rather than the user entry, e.g.: dialupAccess: 1

As far as I can tell there's no attribute value inheritance in LDAP? Short of modifying the source code of rlm_ldap.c and/or the function rlm_ldap_check_access() to explicitly search the profile LDAP entry for the access attribute are there any other strategies I might consider in order to move the access attribute out of the individual user LDAP entries?

You'll probably have to either modify the source, or just write an LDAP query: if (%{ldap:... query for access attribute}" == "") { reject } Alan DeKok.