Map LDAP Attribute to RADIUS Attribute

[Paul Asadoorian]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All:

I am running FreeRADIUS version 1.1.2 on Debian Linux (Stable x86).   
I am trying to map an LDAP attribute to a RADIUS attribute.  A little  
background, we have a RADIUS client that needs to make decisions  
based on an LDAP attribute (we'll call it User-Category).  Based on  
the value of this attribute the end user will be given rights on the  
network.  So, I setup my ldap.attrmap with *only* the following line:

replyItem       User-Category                   orgPrimaryAffiliation

I setup the following config for rlm_ldap:

server = "ldapserver.org.com"
                 identity = "cn=Radius_admin,ou=Special  
Users,dc=org,dc=com"
                 password = 12345
                 basedn = "dc=org,dc=com"
                 filter = "(&(objectclass=*) (orgShortid=%{Stripped- 
User-Name:-%{User-Name}}))"
                 base_filter = "(objectclass=*)"
#               port = 636
                 port = 389

The following debug logs show the successful authentication of the  
user and the mapping of the attributes:

rad_recv: Access-Request packet from host 127.0.0.1:32904, id=192,  
length=58
         User-Name = "mytestuser"
         User-Password = "12345"
         NAS-IP-Address = 255.255.255.255
         NAS-Port = 1812
   Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
   modcall[authorize]: module "preprocess" returns ok for request 4
   modcall[authorize]: module "chap" returns noop for request 4
   modcall[authorize]: module "mschap" returns noop for request 4
     rlm_realm: No '@' in User-Name = "mytestuser", looking up realm  
NULL
     rlm_realm: No such realm "NULL"
   modcall[authorize]: module "suffix" returns noop for request 4
rlm_ldap: - authorize
rlm_ldap: performing user authorization for mytestuser
radius_xlat:  '(&(objectclass=*) (orgShortid=mytestuser))'
radius_xlat:  'dc=org,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=org,dc=com, with filter (& 
(objectclass=*) (orgShortid=mytestuser))
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: Adding orgPrimaryAffiliation as User-Category, value  
student & op=11
rlm_ldap: Setting Auth-Type = ldap
rlm_ldap: user mytestuser authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
   modcall[authorize]: module "ldap" returns ok for request 4
modcall: leaving group authorize (returns ok) for request 4
   rad_check_password:  Found Auth-Type ldap
auth: type "LDAP"
   Processing the authenticate section of radiusd.conf
modcall: entering group LDAP for request 4
rlm_ldap: - authenticate
rlm_ldap: login attempt by "mytestuser" with password "12345"
rlm_ldap: user DN: orgUUID=53d66879-e0a0- 
da8f-4c49-514b567713ad,ou=People,dc=org,dc=com
rlm_ldap: (re)connect to ldapserver.org.com:389, authentication 1
rlm_ldap: bind as orgUUID=53d66879-e0a0- 
da8f-4c49-514b567713ad,ou=People,dc=org,dc=com/12345 to  
ldapserver.org.com:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: user mytestuser authenticated succesfully
   modcall[authenticate]: module "ldap" returns ok for request 4
modcall: leaving group LDAP (returns ok) for request 4
Sending Access-Accept of id 192 to 127.0.0.1 port 32904
Finished request 4

The problem is that I never see the RADIUS server return the "User- 
Category" attribute back to the RADIUS client.  It seems to only want  
to send the "Access-Accept" or "Access-Reject" message with no User- 
Category value.  I tried including the "User-Category" in the request  
with no luck. I also modified the "attrs" file to include this  
attribute:

DEFAULT
         Service-Type == Framed-User,
         Service-Type == Login-User,
         Login-Service == Telnet,
         Login-Service == Rlogin,
         Login-Service == TCP-Clear,
         Login-TCP-Port <= 65536,
         Framed-IP-Address == 255.255.255.254,
         Framed-IP-Netmask == 255.255.255.255,
         Framed-Protocol == PPP,
         Framed-Protocol == SLIP,
         Framed-Compression == Van-Jacobson-TCP-IP,
         Framed-MTU >= 576,
         Framed-Filter-ID =* ANY,
         Reply-Message =* ANY,
         User-Category =* ANY,
         Proxy-State =* ANY,
         Session-Timeout <= 28800,
         Idle-Timeout <= 600,
         Port-Limit <= 2

But no luck there either.  Any help is greatly appreciated.

Thank You,

Paul

- --
Paul Asadoorian
Email:   paul at pauldotcom.com
Web:     http://pauldotcom.com
IRC:      #pauldotcom | irc.freenode.net

Fingerprint: 2693 0204 8497 2E5F 4853  11D5 1153 6151 487F E094






-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFEvjotEVNhUUh/4JQRAqM/AKCWYfgBERhaBQ/xKUDMGD552JPB4QCfTP+v
knyeEwAg7Annq9xXcdwK8s0=
=Gzks
-----END PGP SIGNATURE-----