assigning vlan based on LDAP attribute

[Thibault Le Meur]

> 
> My ldap section from radiusd.conf looks like:
> ldap {
>                 server = "ldapserver.net.org"
>                 identity = "uid=name,dc=net,dc=org"
>                 password = password
>                 basedn = "ou=stuffdc=net,dc=org"
>                 filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
>                 start_tls = no
>                 dictionary_mapping = ${raddbdir}/ldap.attrmap
>                 ldap_connections_number = 5
>                 password_attribute = userPassword
>                 groupmembership_attribute = 
> eduPersonPrimaryAffiliation
>                 timeout = 4
>                 timelimit = 3
>                 net_timeout = 1
>         }
It seems ok to me...

> 
> My users file contains the following at the end:
> DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff
>        User-Name=`%{User-Name}`,
>        Tunnel-Medium-Type=IEEE-802,
>        Tunnel-Private-Group-Id=2,
>        Tunnel-Type=VLAN,
>        Fall-Through = no
> 
> My huntgroups file has:
> myAP            NAS-IP-Address == x.x.x.141
> 
> In my Debug I noticed that although I have them commented out 
> of radiusd.conf, I still see:
> Debug:  ldap: groupname_attribute = "cn"
> Debug:  ldap: groupmembership_filter = 
> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obje
> ctClass=GroupO
> fUniqueNames)(uniquemember=%{Ldap-UserDn})))"


Strange...


> You asked:
> * is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP 
> which uses other format). How do I check that?

Check in your AP documentation ?

But this format is the most commonly used, so I don't think this is the
issue.

Can you send a more complete debug.

Thibault