group authorization

[Brendan Kearney]

On Tue, 2014-03-25 at 15:46 -0400, Alan DeKok wrote:
> Brendan Kearney wrote:
> > i want to have the radiusReplyItem given in a reply when the user is a
> > member of a specific group in ldap, but i seem to be having trouble with
> > that.  it seems that when the ldap query is made for the group
> > membership, the "short" version of the uid (uid=brendan) is being used
> > and not matching.  the actual member "value" in the group is the "long"
> > version of the uid (uid=brendan,ou=Users,dc=bpk2,dc=com).  is there
> > something i can do to use the "long" version?
> 
>   Edit raddb/modules/ldap to use the DN you want:
> 
>  	filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
> 
>   The configuration files are editable for a reason.  Edit them.
> 
>   Alan DeKok.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

i have edited that file, and played with everything i can think of, or
can find to try getting this working.  hence my question here.

for some reason the radiusReplyItem specified as an attribute of the
groupOfNames is not being returned to the radius instance:

[ldap] looking for reply items in directory...
...

the output should be:

[ldap] looking for reply items in directory...
  [ldap] extracted attribute Cisco-AVPair from generic item Cisco-AVPair
= "shell:priv-lvl=15"
...

i dont know what i should be changing to have the correct query done
from the radius side, so that ldap responds with what it already is
configured to respond with.