problems with dynamic vlan assignment

[Eric Doutreleau]

thanks for your replay

here what i did

in the ldap.attrmap i put
checkItem       User-Category eduPersonPrimaryAffiliation

in the user file i did
DEFAULT
         Tunnel-Type := VLAN,
         Tunnel-Medium-Type := IEEE-802,
         Tunnel-Private-Group-Id = 901,
         Fall-Through = Yes

DEFAULT User-Category == "student"
         Reply-Message = "Your a member of the student Group",
         Tunnel-Private-Group-Id = 902

DEFAULT User-Category == "employee"
         Reply-Message = "Your a member of the employee Group",
         Tunnel-Private-Group-Id = 903

in the inner-tunnel  file i have

authorize {
	chap
	mschap
	uni
	suffix
	update control {
	       Proxy-To-Realm := LOCAL
	}
	eap {
		ok = return
	}
	ldap
         files
	expiration
	logintime
	pap
}

i got the following logs
........

[eap] EAP packet type response id 7 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[ldap] performing user authorization for doutrele
[ldap] 	expand: %{Stripped-User-Name} -> doutrele
[ldap] 	expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> 
(uid=doutrele)
[ldap] 	expand: dc=int-evry,dc=fr -> dc=int-evry,dc=fr
   [ldap] ldap_get_conn: Checking Id: 0
   [ldap] ldap_get_conn: Got Id: 0
   [ldap] performing search in dc=int-evry,dc=fr, with filter (uid=doutrele)
[ldap] looking for check items in directory...
   [ldap] eduPersonPrimaryAffiliation -> User-Category == "employee"
   [ldap] sambaNtPassword -> NT-Password == 
0x3846343134354531463530334232353337443430363846343942363633434143
   [ldap] sambaLmPassword -> LM-Password == 
0x4434413632394242394536303843323438423045413541374446313335423033
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that 
the user is configured correctly?
[ldap] user doutrele authorized to use remote access
   [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
[files] users: Matched entry DEFAULT at line 166
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Normalizing NT-Password from hex encoding
[pap] Normalizing LM-Password from hex encoding
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[eap] Freeing handler
++[eap] returns ok
......

THe line 166 in my users file is these ones
DEFAULT
         Tunnel-Type := VLAN,
         Tunnel-Medium-Type := IEEE-802,
         Tunnel-Private-Group-Id = 901,
         Fall-Through = Yes

and i don't match the following entries
DEFAULT User-Category == "employee"
         Reply-Message = "Your a member of the employee Group",
         Tunnel-Private-Group-Id = 903

and i really don't know why

Le 16/09/2010 09:44, Phil Mayers a écrit :
>
>> [ldap] expand: dc=int-evry,dc=fr -> dc=int-evry,dc=fr
>> [ldap] ldap_get_conn: Checking Id: 0
>> [ldap] ldap_get_conn: Got Id: 0
>> [ldap] attempting LDAP reconnection
>> [ldap] (re)connect to ldapdev.int-evry.fr:389, authentication 0
>> [ldap] bind as cn=admin,dc=int-evry,dc=fr/admldap to
>> ldapdev.int-evry.fr:389
>> [ldap] waiting for bind result ...
>> [ldap] Bind was successful
>> [ldap] performing search in dc=int-evry,dc=fr, with filter (uid=doutrele)
>> [ldap] looking for check items in directory...
>> [ldap] sambaNtPassword -> NT-Password ==
>> 0x3846343134354531463530334232353337443430363846343942363633434143
>> [ldap] sambaLmPassword -> LM-Password ==
>> 0x4434413632394242394536303843323438423045413541374446313335423033
>> [ldap] looking for reply items in directory...
>> [ldap] eduPersonPrimaryAffiliation -> User-Category = "employee"
>
> Two issues; first, as above you're adding the User-Category item from
> LDAP into the reply list, but the "files" syntax doesn't (can't) match
> items in the reply this. This:
>
> DEFAULT User-Category == "employee"
>
> means "match all request with the attribute User-Category == employee in
> the *request* items"
>
> Secondly, I think you're running LDAP after "files", so even if it could
> match, it would not.
>
> Try something like this in sites-available/inner-tunnel:
>
> authorize {
> ...
> ldap
> if (reply:User-Category == employee) {
> update reply {
> Tunnel-Private-Group-Id := 1234
> }
> }
> elsif (reply:User-Category == ...) {
> }
>
> }
>
> Or, modify your ldap.attrmap to put the User-Category into the request
> items (assuming your NAS doesn't need it) then move the files module
> after the ldap one.
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html