Updating Reply Attributes in authenticate section

[Matthew Ceroni]

Thanks for the reply.

First, adding an else to the if statement doesn't really help. As that is
in the authorize section that simply queries AD via LDAP to check for
groups of the user. It uses an admin DN to bind and query, not the actual
user credentials (as this is a PEAP) request. So I actually need to set
that attribute in the authenticate section when I determine that
authentication had failed.

All that being said, I was unaware of what you stated in your second
paragraph. I did test that though. I just always return ACCEPT - ACCEPT
when the calling station ID was from the wireless controller. Even when I
provided wrong credentials radius returned ACCEPT-ACCEPT which indicated to
the controller it was successful and the user was able to get on WIFI (just
the wrong VLAN because LDAP found the user in a specific group and assigned
that VLAN).


On Wed, May 1, 2013 at 3:36 PM, <A.L.M.Buxey at lboro.ac.uk> wrote:

> Hi,
>
> >            elsif (Ldap-Group == "netCoreClass-finance") {
> >                    update reply {
> >                            Tunnel-Private-Group-Id:1 := 124
> >                    }
> >            }
> >    Authentication is against Active Directory. So while a user may get
> >    assigned to a VLAN based of their group membership, if they fail to
> >    actually authenticate I want to change what VLAN they are assigned to
> >    (want to put them into a guest VLAN).
> >    How can I update reply attributes further down the chain?
>
>             else  {
>                     update reply {
>                             Tunnel-Private-Group-Id:1 := 666
>                     }
>
> >    The reason I am doing this is I have an old Cisco wireless LAN
> controller
> >    that can't fall back to MAC 802.1x authentication. Therefore if a user
> >    fails with their credentials they fail to authenticate all together.
> So
> >    when coming from the wireless LAN controller I want always Accept.
>
> what type of system is this? 802.1X ? if so, then you cant just blindly
> Access-Accept
> EAP auths if they've got incorrect user/pass - the WPA/WPA2 enterprise key
> is derived from
> mutual agreement.
>
> if, however, this is just eg PAP with some captive portal thing then
> that'd work.
>
> alan
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20130501/b498d6fa/attachment-0001.html>