Hi List,
we are currently using rlm_ldap to check against a LDAP backend, which
works fine so far. rlm_ldap is configured to use a BaseDN of
"ou=poeple,dc=example,dc=org". We have also specified a group membership
filter and are trying to enforce group memberships via the combination
of huntgroups-file and Ldap-Group-Settings in the users file.
According to debug output, this seems to work (since freeradius is
trying to find the groups specified in the users file).
However, our groups are stored underneath "ou=groups,dc=example,dc=org"
- so rlm_ldap is not able to find them with the basedn shown above. We
are also not able to change the basedn to something else, since there is
a different user-tree underneath dc=example,dc=org which should not be
taken into account by freeradius.
Is there is possibility to set a different basedn for group lookups OR
another feasable solution (e.g. modify the filter...?). Filter and
groupmembership_filter are currently set to:
filter =
"(uid=%{Stripped-User-Name:-%{mschap:User-Name}})"
groupname_attribute = cn
groupmembership_filter =
"(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{mschap:User-Name}})"
Debug output states this:
rlm_ldap: performing search in ou=poeple,dc=example,dc=org, with filter
(&(cn=GROUP-NAME-FROM-USERS-FILE)(objectClass=posixGroup)(memberUid=LOGIN-USER))
Thanks in advance for your help!
--
Mit freundlichen Grüßen / with kind regards
Rudolph Bott
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
