Initial support of Multi Valued Attributes operators

Olivier Beytrison olivier at
Mon Mar 25 17:50:26 CET 2013


I've sent a pull request to add the initial support of MVA operators.

This add 4 new operators to perform basic comparison with multivalued

* |== At least one attribute should equal the value
* &== All attributes should equal the value
* |=~ At least one attribute should match the regular expression
* &=~ All attributes should match the regular expression
The allowed syntax are

attribute-name &==/|== "double quoted string with xlat expansion"
attribute-name &==/|== 'single quoted string for a fixed value'
attribute-name &=~/|=~ /regular expression/flag

With the regexp, we're not matching against group. It will not populate
the %{0} %{1} variables

Their inverse is not available. Simply encapsulate their call inside !()

For example, this will allow to simply check ldap-group with unlang
without building a foreach loop or using huntfile. Arran is in the
process to add this feature to rlm_ldap.

With those operators, it would also make sense to retrieve all values
with sql/ldap xlat. But this is to be discussed.

The code has been tested here and it performs well. I tried to make it
as clean as possible. What's left to do is update the unlang man page
and the wiki. Well, if it is merged :)


 Olivier Beytrison
 Network & Security Engineer, HES-SO Fribourg
 Mail: olivier at

More information about the Freeradius-Devel mailing list