Ldap-Group DN and the match "=~" check

[Phil Mayers]

Thibault Le Meur wrote:
> Hello,
> 
> I've made a little test and found that the match operator "=~" doesn't work
> on my setup (Freeradius 1.0.4) for Groups defined as LDAP DNs.
> 
> Indeed I'd like to to use the following rule (in the users file):
> 
> DEFAULT Ldap-Group =~
> "cn=mygroupname,ou=(unit1|unit2|unit3),dc=mycorp,dc=org"
> 	Fall-Through = no
> 
> This way, a unique rule will match 3 different groups having the same cn,
> but in different subtrees.
> 
> Am I missing something or is this setup impossible with Ldap-Groups ?

You are missing something.

Ldap-Group is not a real attribute that's copied to the config items. 
It's a "virtual" attribute. At runtime, the right-hand-side of the 
comparison is searched for in the LDAP directory.

There's no way to do what you want currently. Source code changes and/or 
clever use of the ldap xlat might do it (see doc/rlm_ldap)