FreeRadius - Pass LDAP Group (Attribute?) to RSSO?

[Alan DeKok]

On Dec 13, 2017, at 12:50 PM, Matthew Stavert <matthew.stavert at nlsd.ab.ca> wrote:
> 
>> *What, exactly do you need to do?  Write that down, first.  e.g.*
> I need to identify the group the user is in once they are authenticated,
> and then pass the users's group to the Dynamic RSSO group on the Fortigate
> using the Class attribute I believe.
> A picture is worth 1000 words...or something like that:

  The list strips pictures.  Too many people were posting PNGs of screen captures showing debug logs in a terminal window.


> [image: Inline image 2]
> The user names are being passed from freeradius, but the user's are not
> there.

  Where is "there"?

> To pass the user's LDAP group, I believe I need to identify which group
> they are a part of in freeradius, and put that in CLASS.

  That's what I said...

> 
>> * If they're a member of LDAP group X, send class Y.*
> 
>> etc.
> Yes, this is what I need to do.  If member of student, send Class=students,
> If member of admins send class=admins, if member of staff, send class=staff.
> Would I have to identify some of this in the LDAP module, or is free radius
> Version 3, smart enough to identity what group the user is a part of in
> LDAP?

  It doesn't read your mind.  You need to configure it to do what you want.

  And the documentation helps here...

>  If it is, I imagine I can just move to implementing in unlang.  If
> not...can you provide me with some guidance where I would start identifying
> or how I would identify what gorup the user was a part of in free radius,
> and what file that would go in?

  http://wiki.freeradius.org

  Type "ldap group" into the search bar.  Read the documentation.

>> *Then... implement that in unlang.*
> What conf file and area would be the best place to put the unlang if
> statements, IE:

  All of this is documented.

>> *And upgrade to v3.  It will be infinitely easier to do this (and debug
> it), than in 2.1.1.*
> 
> I will be upgrading to version 3 today, and getting this all going on the
> newest server.

  That's good.

  Alan DeKok.