Re: Multivalued (LDAP) Attributes and string matching, or regexes

2011-06-21 Thread Jason Antman
Alexander Clouter wrote: Peter Lambrechtsen plambrecht...@gmail.com wrote: I find the easist way to do it is to use a custom users file to allow / prevent access based on exact matches of LDAP attributes. then you can say if STAFF = Accept, if STAFF OFFSITE Accept, otherwise reject. This

Re: Multivalued (LDAP) Attributes and string matching, or regexes

2011-06-21 Thread Alexander Clouter
Jason Antman jant...@oit.rutgers.edu wrote: I don't really know anything about it, and haven't seen mention of it outside of the modules list, but perhaps I could use rlm_perl or rlm_python? Does anyone know about the efficiency of these? I know I'm approaching this from the standpoint of

Re: Multivalued (LDAP) Attributes and string matching, or regexes

2011-06-21 Thread Jason Antman
Alexander Clouter wrote: I thought I remembered this popping up recently, I would have mentioned it earlier but my Google-Fu at the time was weak and I though I was imagining things. If you checkout v2.1.x[1] and then type: $ git checkout -b foreach $ git cherry-pick a3221304 $ git

Re: Multivalued (LDAP) Attributes and string matching, or regexes

2011-06-16 Thread Alexander Clouter
Peter Lambrechtsen plambrecht...@gmail.com wrote: I find the easist way to do it is to use a custom users file to allow / prevent access based on exact matches of LDAP attributes. then you can say if STAFF = Accept, if STAFF OFFSITE Accept, otherwise reject. This is how we do it here:

Multivalued (LDAP) Attributes and string matching, or regexes

2011-06-15 Thread Jason Antman
Greetings, I have to control authorization based on a (possibly) multi-valued LDAP reply attribute called employeeType. I have all of the LDAP code working fine, but seem to have hit a snag. Each user has 1 to ??? (usually a max of 5 or so) employeeType values. The pertinent ones include

Re: Multivalued (LDAP) Attributes and string matching, or regexes

2011-06-15 Thread Peter Lambrechtsen
I find the easist way to do it is to use a custom users file to allow / prevent access based on exact matches of LDAP attributes. then you can say if STAFF = Accept, if STAFF OFFSITE Accept, otherwise reject. This is how we do it here: