Hi Alan
I RTM unlang, but I have to admit I only got confused - The only thing
I have understood is to write a simple statement like this (in
authorize section)
if (NAS-Identifier == "ftp" ) {
ok
}
else {
reject
}
and I think is even wrong because returns always OK :(((((
I noticed on some posts people using a syntax like if (NAS-Identifier
== %{sql: SELECT ... BLA BLA} )
but I have not been able to see a working example using ldap, ... may
you provide an example, please? I've not been able to figure out how
to write it down.
my situation is this: eckAllowedServices is a multistring attribute
that contains a NAS-Identifier per line. I use service names as NAS-
Identifiers in order to perform users authorization to services - eg
authorize ftp access on a per users basis
this is what happen when I do a ldapsearch
ldapsearch -LLL -b cn=testuser,ou=Users,dc=marcolinux,dc=local
eckAllowedServices -x -D
"CN=FreeRADIUS,OU=AAA,OU=Services,DC=marcolinux,DC=local" -w
wRtEYnd3sGkEa.Y4
dn: cn=testuser,ou=Users,dc=marcolinux,dc=local
eckAllowedServices: ftp
eckAllowedServices: httpProxy
that shows that the DN used by freeradius is able to read
eckAllowedServices attribute
as I wrote in the previous post, I updated ldap.attrmap inserting the
following line
checkItem NAS-Identifier eckAllowedServices
in order to do the "binding" between radius and LDAP
and this is the extension of the LDAP schema (eck.schema)
attributetype ( 1.3.6.1.4.1.26309.1.1.11 NAME 'eckAllowedServices'
DESC 'Services the user is allowed to login' EQUALITY
caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.26{128} )
objectClass ( 1.3.6.1.4.1.26309.1.1.1 NAME 'eckGenericObject'
AUXILIARY DESC 'an ECK generic object' MAY ( locked $
eckPublicKey $ eckPrivateKey $ userPKCS12 $ allowProxy $
eckAllowedServices))
thinking at the %{sql:SELECT ...} example I tough I syntax almost like
this
if (NAS-Identifier == "ldap:cn=%{User-
Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) {
ok
}
else {
reject
}
the aim is to check if NAS-Identifier supplied by the NAS is equal to
one of the multivalue strings of eckAllowedServices
but I always got this message - it doesnt matter if the user has got
or hasn't the eckAllowedServices attribute:
if (NAS-Identifier == "ldap:cn=%{User-
Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" )
expand: ldap:cn=%{User-Name},ou=Users,dc=marcolinux,dc=local
(eckAllowedServices) ->
ldap:cn=testuser,ou=Users,dc=marcolinux,dc=local (eckAllowedServices)
? Evaluating (NAS-Identifier == "ldap:cn=%{User-
Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) -> FALSE
++? if (NAS-Identifier == "ldap:cn=%{User-
Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) -> FALSE
++- entering else else {...}
+++[reject] returns reject
I gave a look to ldap.log - with verbose debugging, ... I found
references to eckAllowedServices, but not as a request for only one
attribute - as I was expecting for the unlang expression I wrote: I
got it mixed with lots of other attributes - that is the previous ldap
lookup of the ldap module of the authorization section: in other words
- I think the unlang expression above is useless and is not processed
with a query to the ldap server . I certainly mis-typed the syntax,
but I'm not able to figure a syntax :(((
Alan, may you provide an example unlang for LDAP? Maybe I am slow
learner, but I think it could help me (and I hope others) a lot
Ah - I use freeradius2-2.1.7-7.el5 - that is the "official" from
RedHat/CentOS - please, don't tell me I have to repackage it to 2.1.10
- I had done this with quite a lot of other packages in ECK
Il giorno 23/nov/10, alle ore 14:33, Alan DeKok ha scritto:
marco wrote:
Sorry Alan
I've not realized that the logs had became a garbage :O( - maybe a
webmail realted issue of my ISP.
Now I Bcc myself to see how does it appear to recipients
I tried "man unlang" but got no manual entry - I'm using Freeradius
packaged for CentOS - I'll give a look to http://freeradius.org/radiusd/man/unlang.html
, I think is the same.
<shrug> Upgrade to 2.1.10. You're using a very old version of the
server.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
