user groups in ldap

[Aqdas Muneer]

Hello,

I have setup freeradius with ldap lookup to authentication Cisco shell
access. As if now i have 2 groups setup in the ldap database. One is for
network admins who have full access to every device. The second group is
for support staff that only have read access to all the devices, but within
this group are some individuals who need full access to some devices. I'm
trying to figure out what will be the best way to implement this? Do i
create another group in ldap and make them members of that group (not sure
if this will work because if one group is matched the searched will be
stopped in the users file)? Do i use unlang to modify the accept-accpet
based on username and NAS-ip? i trying to keep this as hands off as
possible when it comes to management in the long run. If anyone has any
experience dealing with such an issues, your advice will be greatly
appreciated.

Thanks in advance for you help.

Aqdas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120821/cc0ca9c1/attachment.html>