Hello,
I would be grateful for any assistance with an implementation of freeradius that I am
working on using Ldap-Groups
I would like to ask if it is possible to use Ldap-Group in the users file and specify
different instances of the ldap module for Ldap-Group to look for groupmembership
attributes
In the user file I can successfully define different, auth, autz , realms to use
whichever of the ldap instances is required - authenticate them and
then assign them an ip from the defined ip pool. However when I try to use
"Ldap-Group" in the users file as a "match" it only ever seems to use 1 of the ldap
look ups regardless of what is defined for that
particular user ( in this case it always tries to do the lookup using ldap2 detailed
below ) -
Here is an example of what I have set up at the mo:
I have 2 instances of the ldap module defined ( excuse me for blanking out any real
references to our network and changing names/ip addresses )
they are very similar except that they lookup slightly different attributes in the
ldap server for authentication and also lookup a different groupname attribute
The idea is that if you source from one type of connection through one type of NAS the
radius server will look for a different arbitrary groupname attribute to match against
and then if you source from a different type of connection ( i.e ISDN, DIAL-UP) the
other ldap instance should be used to look for ldapgroup attributes
in other words I want to define multiple groupnames per ldapaccount and have the
Ldap-Group use different instance depending on where you are sourcing from
so if you have a user account that is defined as follows in the ladp server
Jo Bloggs
Active = yes
location = remoteoffice [ <- this is a groupname attribute ]
dailupoffice=yes
dailupgroup = home [ <- this is the theothergrouname ]
dailuphomeenabled = yes
ldap ldap1 {
server = "127.0.0.1";
basedn = "ou=****,o=****"
filter = "(&(dialuphomeenabled=yes)(active=yes)(uid=%U))"
start_tls = no
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 5
groupname_attribute = dailupgroup
groupmembership_filter = "(uid=%U)"
groupmembership_attribute = dailupgroup
timeout = 4
timelimit = 3
net_timeout = 1
}
ldap ldap2 {
server = "127.0.0.1";
basedn = "ou=*****,o=*******"
filter = "(&(dailupoffice=yes)(active=1)(uid=%U)) "
start_tls = no
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 5
groupname_attribute = location
groupmembership_filter = "(uid=%U)"
groupmembership_attribute = location
timeout = 4
timelimit = 3
net_timeout = 1
}
####################
Autz-Type ONE {
ldap1
}
Autz-Type TWO {
ldap2
}
#################
Auth-Type ONE {
ldap1
}
Auth-Type TWO {
ldap2
}
###########################
Users file :
DEFAULT Realm == "***********", Ldap-Group == "home", Autz-Type := "ONE", Auth-Type
:= "ONE", Post-Auth-Type := "******", Pool-Name := "****"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-MTU = 1500,
Framed-Compression = Van-Jacobsen-TCP-IP,
MS-Primary-DNS-Server = *******,
MS-Secondary-DNS-Server = *******
DEFAULT Ldap-Group == "remoteoffice", Auth-Type := TWO, Post-Auth-Type := "*******",
Pool-Name :="DIFFERNETTOTHEONEABOCE"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-MTU = 1500,
Framed-Compression = Van-Jacobsen-TCP-IP
Kind regards
Josh
Wide Area Network Engineer
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
