Tricky problem with ldap and primary groups in AD

[Alan DeKok]

Franks Andy (RLZ) IT Systems Engineer wrote:
> 2)      Check the primarygroupid attribute out by mapping it using
> ldap.attrmap and attributes in the dictionary file, but then as far as I
> can tell I can’t use these as checkitems within the users file.

  So?  See "man unlang".  You can write policies directly in the
configuration files.

> It’s
> also tedious to have to know the primarygroupIDs for each group. I’d
> quite like the users file to be the main source of passing radius
> attributes back to clients, but there may be another way?

  LDAP makes this difficult.

  Alan DeKok.