On Wed, Aug 04, 2004 at 10:52:28AM -0400, Alan DeKok wrote: > "Geoffrey Cauchi" <[EMAIL PROTECTED]> wrote: > > Did you have any reply re. this? We are facing a very similar problem and > > it would be greatly appreciated if you could tell us how you solved the > > problem. > > So far, I don't think he has. > > I've taken a quick look at the problem, but I'm not sure what's > going wrong, so I'm not sure I can suggest any fix or work-around. > > Alan DeKok.
OK, I have looked at the rlm_ldap documentation and here is what I have. I have restarted radiusd and everyone is still able to log into each device successfully. I only want certain people with matching radiusGroupName attributes to be able to log into the respective device and anyone else to be rejected. What am I doing wrong here: 1) In the users file, I have the following (pay attention to the Ldap-Group entry): DEFAULT Huntgroup-Name == "Cisco" Auth-Type := LDAP, Service-Type := 6, Ldap-Group == cisco, Fall-Through = Yes DEFAULT Huntgroup-Name == "Juniper-E-series" Auth-Type := LDAP, Ldap-Group == junipere, Fall-Through = Yes DEFAULT Huntgroup-Name == "Juniper-M-Series" Auth-Type := LDAP, Ldap-Group == juniperm, Fall-Through = No 2) My LDAP schema has the following (pay attention to radiusGroupName): dn: uid=homer, ou=people, dc=test, dc=net objectclass: person objectclass: radiusprofile objectclass: uidObject objectClass: inetOrgPerson objectClass: posixAccount objectClass: extensibleObject cn: Homer Simpson sn: Simpson loginShell: /bin/bash userpassword: {SSHA}vFGHHGJxzesR5Y/rodHeQbF9yiAAxbMP uidnumber: 2001 gidnumber: 20 homeDirectory: /home/homer uid: homer shadowLastChange: 10877 shadowMin: 0 shadowMax: 999999 shadowWarning: 7 shadowInactive: -1 shadowExpire: -1 shadowFlag: 0 radiusAuthType: LDAP radiusReplyItem: Juniper-Local-User-Name := tier3 radiusReplyItem: ERX-Cli-Initial-Access-Level := "15" radiusReplyItem: ERX-Alternate-Cli-Access-Level := "15" radiusReplyItem: ERX-CLI-Allow-All-VR-Access := 1 radiusReplyItem: Cisco-AVPair := "shell:priv-lvl=15" radiusGroupName: cisco radiusprofileDN: uid=homer, ou=people, dc=test, dc=net 3) In my radiusd.conf file, I have groupname_attribute = radiusGroupName and groupmembership_attribute = radiusGroupName. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html