Re: Add LDAP groups as extra attributes

2013-03-19 Thread Robin Helgelin
On Fri, Mar 15, 2013 at 2:03 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: I know, but that attribute isn't presented to the python function call. Is there another way such as an environmental variable or just please update the source? :) Did you check the control list (config

Re: Add LDAP groups as extra attributes

2013-03-15 Thread Robin Helgelin
On 14 mar 2013, at 18:44, Arran Cudbard-Bell wrote: That'd be the LDAP-UserDN attributeā€¦ I know, but that attribute isn't presented to the python function call. Is there another way such as an environmental variable or just please update the source? :) regards, Robin - List

Re: Add LDAP groups as extra attributes

2013-03-15 Thread Arran Cudbard-Bell
On 15 Mar 2013, at 08:43, Robin Helgelin lob...@gmail.com wrote: On 14 mar 2013, at 18:44, Arran Cudbard-Bell wrote: That'd be the LDAP-UserDN attributeā€¦ I know, but that attribute isn't presented to the python function call. Is there another way such as an environmental variable or

Re: Add LDAP groups as extra attributes

2013-03-14 Thread Phil Mayers
On 03/13/2013 07:45 PM, Robin Helgelin wrote: First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right? Yes, though TBH manipulating LDAP DNs in unlang/attr_rewrite is going to be a pain.

Re: Add LDAP groups as extra attributes

2013-03-14 Thread Robin Helgelin
On 14 mar 2013, at 11:06, Phil Mayers p.may...@imperial.ac.uk wrote: On 03/13/2013 07:45 PM, Robin Helgelin wrote: First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right? Yes,

Re: Add LDAP groups as extra attributes

2013-03-14 Thread Arran Cudbard-Bell
On 14 Mar 2013, at 13:39, Robin Helgelin lob...@gmail.com wrote: On 14 mar 2013, at 11:06, Phil Mayers p.may...@imperial.ac.uk wrote: On 03/13/2013 07:45 PM, Robin Helgelin wrote: First problem is that I need to rewrite the output from ldap to something the radius-client finds useful.

Add LDAP groups as extra attributes

2013-03-13 Thread Robin Helgelin
Hi! I want to add the LDAP-users current groups as extra attributes to the authentication reply. Is it possible? I'm having a hard time finding documentation about this. Thanks! Robin - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Phil Mayers
On 13/03/13 14:44, Robin Helgelin wrote: Hi! I want to add the LDAP-users current groups as extra attributes to the authentication reply. Is it possible? I'm having a hard time finding documentation about this. Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Arran Cudbard-Bell
On 13 Mar 2013, at 10:52, Phil Mayers p.may...@imperial.ac.uk wrote: On 13/03/13 14:44, Robin Helgelin wrote: Hi! I want to add the LDAP-users current groups as extra attributes to the authentication reply. Is it possible? I'm having a hard time finding documentation about this. Yes.

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Phil Mayers
On 13/03/13 15:11, Arran Cudbard-Bell wrote: Phili is correct, but this will only work for something like AD, where you have memberOf attributes which link a user account to a group. Good point, got to watch that - my LDAP is getting very AD-centric :o( - List info/subscribe/unsubscribe? See

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Robin Helgelin
On Wed, Mar 13, 2013 at 4:11 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS attribute, and add the RADIUS attribute to raddb/dictionary (taking care to note the comments about numbering i.e. pick a number from

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Arran Cudbard-Bell
On 13 Mar 2013, at 15:45, Robin Helgelin lob...@gmail.com wrote: On Wed, Mar 13, 2013 at 4:11 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS attribute, and add the RADIUS attribute to raddb/dictionary (taking

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Robin Helgelin
On 13 mar 2013, at 20:52, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct? Ignores what? If you're talking about an xlat query, then yes, it'll only provide the first result.

Re: Add LDAP groups as extra attributes

2013-03-13 Thread Arran Cudbard-Bell
On 13 Mar 2013, at 16:17, Robin Helgelin lob...@gmail.com wrote: On 13 mar 2013, at 20:52, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct? Ignores what? If you're talking