I don't think you need to do that. Check out http://www.doris.cc/radius.
You can have the same lookup, just the uid, but then check for a certain
group based on the NAS-IP or NAS-Port-Type etc.. What you are doing is
looking for something like dialuphomeenabled=yes as well as the uid when
authorizing the user now.
Instead you can make the ldap-group what they have access to. So you
setup something like radiusGroupName in ldap and allow it to contain
multiple values. In radiusd.conf you make 1 auth/autz profile and have
the groupname say radiusgroupname.
Example, in ldap joe has both dialupoffice and dialuphome
uid: joe
radiusgroupname: dailupoffice
radiusgroupname: dialuphome
Now when something comes in from say a particular area or port-type then
you search for membership of that group.
So say you wanted people on ISDN circuits to equal dialupoffice and Async
to be dialuphome.
Then in users file you add
DEFAULT NAS-Port-Type == ISDN, Ldap-Group == dialupoffice
Fall-Through = no
DEFAULT NAS-Port-Type == Async, Ldap-Group == dialuphome
Fall-Through = no
DEFAULT Auth-Type := Reject
What will happen is uid of joe tries to authenticate. If he is on an
Async line, then ldap will search to see if radiusgroupname: dialuphome
exists for this user. If not, then it will fall through to reject. If he
comes in on an ISDN line, then it will search for radiusgroupname:
dialupoffice.
In this case, joe would be authorized for both. If you wanted to disable
his ISDN line, then you just take out the radiusgroupname: dialupoffice
attribute from ldap and you are done. If he then needs access back, you
re-add that attribute to ldap.
Now, if you wanted different criteria say, NAS-IP instead of
NAS-Port-Type, then you just change
DEFAULT NAS-Port-Type == Async ...
to
DEFAULT Nas-IP-Address == x.x.x.x, Ldap-Group == whatever.
Now users coming in from a particular nas ip need to have a particular
groupname.
Make sense?
I think you can avoid calling multiple ldap authentication/authorization
methods by using that.
Hope that is helpful.
Dusty Doris
On Wed, 17 Mar 2004, Josh Fry wrote:
> Hello,
> I would be grateful for any assistance with an implementation of freeradius that I
> am working on using Ldap-Groups
> I would like to ask if it is possible to use Ldap-Group in the users file and
> specify different instances of the ldap module for Ldap-Group to look for
> groupmembership attributes
>
> In the user file I can successfully define different, auth, autz , realms to use
> whichever of the ldap instances is required - authenticate them and
> then assign them an ip from the defined ip pool. However when I try to use
> "Ldap-Group" in the users file as a "match" it only ever seems to use 1 of the ldap
> look ups regardless of what is defined for that
> particular user ( in this case it always tries to do the lookup using ldap2
> detailed below ) -
>
> Here is an example of what I have set up at the mo:
>
> I have 2 instances of the ldap module defined ( excuse me for blanking out any real
> references to our network and changing names/ip addresses )
> they are very similar except that they lookup slightly different attributes in the
> ldap server for authentication and also lookup a different groupname attribute
>
> The idea is that if you source from one type of connection through one type of NAS
> the radius server will look for a different arbitrary groupname attribute to match
> against
> and then if you source from a different type of connection ( i.e ISDN, DIAL-UP) the
> other ldap instance should be used to look for ldapgroup attributes
>
> in other words I want to define multiple groupnames per ldapaccount and have the
> Ldap-Group use different instance depending on where you are sourcing from
>
> so if you have a user account that is defined as follows in the ladp server
>
> Jo Bloggs
> Active = yes
> location = remoteoffice [ <- this is a groupname attribute ]
> dailupoffice=yes
> dailupgroup = home [ <- this is the theothergrouname ]
> dailuphomeenabled = yes
>
>
>
>
> ldap ldap1 {
> server = "127.0.0.1";
> basedn = "ou=****,o=****"
> filter = "(&(dialuphomeenabled=yes)(active=yes)(uid=%U))"
> start_tls = no
> dictionary_mapping = ${raddbdir}/ldap.attrmap
> ldap_connections_number = 5
> groupname_attribute = dailupgroup
> groupmembership_filter = "(uid=%U)"
> groupmembership_attribute = dailupgroup
> timeout = 4
> timelimit = 3
> net_timeout = 1
> }
>
>
> ldap ldap2 {
> server = "127.0.0.1";
> basedn = "ou=*****,o=*******"
> filter = "(&(dailupoffice=yes)(active=1)(uid=%U)) "
> start_tls = no
> dictionary_mapping = ${raddbdir}/ldap.attrmap
> ldap_connections_number = 5
> groupname_attribute = location
> groupmembership_filter = "(uid=%U)"
> groupmembership_attribute = location
>
> timeout = 4
> timelimit = 3
> net_timeout = 1
> }
>
> ####################
>
> Autz-Type ONE {
> ldap1
> }
>
> Autz-Type TWO {
> ldap2
> }
>
> #################
>
>
>
> Auth-Type ONE {
> ldap1
> }
>
> Auth-Type TWO {
> ldap2
> }
>
> ###########################
>
>
>
> Users file :
>
>
>
>
> DEFAULT Realm == "***********", Ldap-Group == "home", Autz-Type := "ONE", Auth-Type
> := "ONE", Post-Auth-Type := "******", Pool-Name := "****"
> Service-Type = Framed-User,
> Framed-Protocol = PPP,
> Framed-MTU = 1500,
> Framed-Compression = Van-Jacobsen-TCP-IP,
> MS-Primary-DNS-Server = *******,
> MS-Secondary-DNS-Server = *******
>
>
> DEFAULT Ldap-Group == "remoteoffice", Auth-Type := TWO, Post-Auth-Type :=
> "*******", Pool-Name :="DIFFERNETTOTHEONEABOCE"
> Service-Type = Framed-User,
> Framed-Protocol = PPP,
> Framed-MTU = 1500,
> Framed-Compression = Van-Jacobsen-TCP-IP
>
>
>
>
> Kind regards
>
> Josh
>
> Wide Area Network Engineer
>
>
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
