Using the contents of LDAP-Group

[Matthew Newton]

On 14/12/2020 11:20, Michael Schwartzkopff wrote:
> I want to reply with the contents of the LDAP-Group Attribute.

LDAP-Group is magic, you can't treat it like a normal attribute.

> So I'd like to do something like
> 
> 
> if ( LDAP-Group) {
>    update reply {
>      Reply-Message += "%{LDAP-Group}"
>    }
> }
> 
> 
> This does not work. First of all, the if condition is never met. Also
> the Reply-Message is empty if

The LDAP-Group attribute doesn't exist. It is an internal "special" 
attribute which does tests, it doesn't have a value. So you can use it 
to check groups, but not to find out which groups the user is in. See 
the group search config options for rlm_ldap.

A user could be in thousands of groups. Expanding a list of them all 
does not generally make sense.

You can use an if/elsif construct to update the Reply-Message, testing 
for each group, as you have already got working.

Or you may be able to come up with an ldap xlat which returns the 
information you need in your own situation, e.g. you know that a user 
will only ever be in one group (otherwise the xlat will only return the 
first one that is returned).

-- 
Matthew