add attribute to Access-Accept

[Gary Prosser]

We have freeradius running successfully with 3 ldap instances (one for
each of 3 different sets of user credentials, two of which are active
directory).

We want to provide to the calling nas in the Access-Accept reply some
identifier of the ldap instance that authorizes a user. I have not been
able to achieve this.

Freeradius -X output shows

rlm_ldap: - authorize
rlm_ldap: performing user authorization for leesle
        expand: %{Stripped-User-Name} ->
        expand: %{User-Name} -> leesle
        expand: (samAccountName=%{%{Stripped-User-Name}:-%{User-Name}})
-> (samAccountName=leesle)
        expand: OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk ->
OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in
OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk, with filter
(samAccountName=leesle)
rlm_ldap: checking if remote access for leesle is allowed by
samAccountName
rlm_ldap: No default NMAS login sequence
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that
the user is configured correctly?
rlm_ldap: Setting Auth-Type = ldap1
rlm_ldap: user leesle authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap1] returns ok

And then two further authorize sections 

++[ldap2] returns notfound
++[ldap3] returns notfound

Then
    users: Matched entry DEFAULT at line 159
    users: Matched entry DEFAULT at line 163
    users: Matched entry DEFAULT at line 167
++[files] returns ok
rlm_pap: WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
  rad_check_password:  Found Auth-Type ldap1
auth: type "ldap1"
+- entering group authenticate
rlm_ldap: - authenticate
rlm_ldap: login attempt by "leesle" with password "xxxxx"
rlm_ldap: user DN: CN=Seonghye
Lee,OU=Students,DC=PUBLIC,DC=TRINITY-BRIS,DC=AC,DC=UK
rlm_ldap: (re)connect to 192.168.4.250:389, authentication 1
rlm_ldap: bind as CN=Seonghye
Lee,OU=Students,DC=PUBLIC,DC=TRINITY-BRIS,DC=AC,DC=UK/16763673 to
192.168.4.250:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: user leesle authenticated succesfully
++[ldap1] returns ok
Login OK: [leesle/xxxxx] (from client esther2-webserver port 0)
Sending Access-Accept of id 91 to 192.168.2.1 port 1026
        Callback-Id := "TCBStaff"

I have tried to put a new attribute into the Access-Accept reply via
users file

    159 DEFAULT Auth-Type == "ldap1"
    160         Callback-Id = "TCBStudents",
    161         Fall-Through = Yes
    162 #
    163 DEFAULT Auth-Type == "ldap2"
    164         Callback-Id := "BBCUsers",
    165         Fall-Through = Yes
    166 #
    167 DEFAULT Auth-Type == "ldap3"
    168         Callback-Id := "TCBStaff",
    169         Fall-Through = Yes

Since each line in users apparantly matches, the attribute Callback-Id
acquires the value of the last DEFAULT. Meanwhile I was hoping that
rlm_ldap: Setting Auth-Type = ldap1 
would match only the first.

Can I fix this by adjusting the syntax or do I need a different method ?

Any comment appreciated !


Gary Prosser
-  
IT Manager
Trinity College, Bristol (http://www.trinity-bris.ac.uk)



To ensure you receive email from Trinity College into your inbox, please add @trinity-bris.ac.uk to your email safe list (also known as whitelist).