Caching Multiple LDAP Groups

[Jonathan Gryak]

I am attempting to cache multiple LDAP groups for use post-authentication
This is an EAP-PEAP connection. Only the last group added to the cache is
available. How can I cache (and access) all of the groups?

 I am running FreeRADIUS Version 3.0.12 (git #34f7ba7), built on Apr  6
2016 at 08:07:17. Below is the relevant debug output:

Expanding LDAP groups:

> (7) ldap: Adding cacheable user object memberships
> (7) ldap:   &control:LDAP-Cached-Membership += "Group1"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group2"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group3"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group4"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group5"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group6"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group7"
> (7) ldap:   &control:LDAP-Cached-Membership += "Group8"


Cache Update:

> (7)         [ldap] = ok
> (7)       } # if (notfound)  = ok
> (7) cache: EXPAND %{User-Name}
> (7) cache:    --> jgryak
> (7) cache: No cache entry found for "jgryak"
> (7) cache: Creating new cache entry
> (7) cache: EXPAND Cache last updated at %t
> (7) cache:    --> Cache last updated at Thu Apr 14 13:51:49 2016
> (7) cache:   &reply:Reply-Message += Cache last updated at Thu Apr 14
> 13:51:49 2016
> (7) cache: EXPAND %{randstr:ssssssssssssssssssssssssssssssss}
> (7) cache:    --> DWiDAixrzMh3hzN93m5QB9rWClbz.cMl
> (7) cache:   &reply:Class :=
> 0x44576944416978727a4d6833687a4e39336d355142397257436c627a2e634d6c
> (7) cache:   control:LDAP-Cached-Membership +=
> &control:LDAP-Cached-Membership -> 'Group8'
> (7) cache: Merging cache entry into request
> (7) cache:   &reply:Reply-Message += "Cache last updated at Thu Apr 14
> 13:51:49 2016"
> (7) cache:   &reply:Class :=
> 0x44576944416978727a4d6833687a4e39336d355142397257436c627a2e634d6c
> (7) cache:   &control:LDAP-Cached-Membership += "Group8"
> (7) cache: Committed entry, TTL 3600 seconds


Post-Auth section:
(8)   # Executing section post-auth from file
/opt/fr3/etc/raddb/sites-enabled/inner-tunnel
(8)     post-auth {
(8)       policy set_role_or_vlan {
(8)         if (NAS-Port-Type == "Wireless-802.11") {
(8)         if (NAS-Port-Type == "Wireless-802.11")  -> TRUE
(8)         if (NAS-Port-Type == "Wireless-802.11")  {
(8)           foreach &control:LDAP-Cached-Membership
(8)             switch %{Foreach-Variable-0} {
(8)             EXPAND Foreach-Variable-0
(8)                --> Group8
(8)             EXPAND %{Foreach-Variable-0}
(8)                --> Group8
(8)             } # switch %{Foreach-Variable-0} = noop
(8)           } # foreach &control:LDAP-Cached-Membership = noop
(8)           if ("%{mschap:User-Name}" =~/\$$/) {


Thank you for your help.
-- 
Jonathan Gryak
Infrastructure Manager

Westport Public Schools
Technology Center
136 Riverside Avenue
Westport, CT 06880
(203) 341-1211