Re: Confused by doc/variables.txt
Alan DeKok wrote: Craig Huckabee <[EMAIL PROTECTED]> wrote: However, if I use this: DEFAULT User-Name =~ "^([^/]+)/(.*)" Foo = `%{2}` ... then attempt to look at Foo using %{reply:Foo}, I get the expected value and the filter works. Try the original, but look for foo in %{Foo}, or %{request:Foo} Alan DeKok. Doesn't work - both %{Foo} and %{request:Foo} come back empty when setting Foo on the check line in users. :( Anything else you can think of ? --Craig - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Craig Huckabee <[EMAIL PROTECTED]> wrote: > Doesn't work - both %{Foo} and %{request:Foo} come back empty when > setting Foo on the check line in users. Hmm... > Anything else you can think of ? Try using another attribute. Or, follow the code execution in src/modules/rlm_files/rlm_files.c Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Alan DeKok wrote: Craig Huckabee <[EMAIL PROTECTED]> wrote: Doesn't work - both %{Foo} and %{request:Foo} come back empty when setting Foo on the check line in users. Hmm... Anything else you can think of ? Try using another attribute. Or, follow the code execution in src/modules/rlm_files/rlm_files.c Alan DeKok. I may try the latter later on today. Thanks! --Craig -- / Craig Huckabee| e-mail: [EMAIL PROTECTED] / / Code 715-CH | phone: (843) 218 5653 / / SPAWAR Systems Center | close proximity: "Hey You!" / / Charleston, SC|ICBM: 32.78N, 79.93W / - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
On Tue, 4 May 2004, Craig Huckabee wrote: > > Where can the regular expressions discussed in 'doc/variables.txt' be > used ? I'd like to modify the User-Name attribute as passed in for use > as a filter for rlm_ldap. > > For example, during an EAP-TLS, I get an EAP packet like this: > > NAS-IP-Address = ... > NAS-Port-Type = Async > User-Name = "host/g21476.fo.bar" > Service-Type = Framed-User > Framed-MTU = 1500 > Calling-Station-Id = ... > State = ... > EAP-Message = ... > Message-Authenticator = ... > > > I'd like to strip off the 'host/' from User-Name and use that as a > filter in rlm_ldap for the authorize step, like: > > ldap { > ... > User-Name =~ "^([^/]+)/(.*)" > filter = "(cn=`%{2}`)" > ... >} > That fails horribly (cn='') so I'm not sure where those types of regex > statements can be used in radiusd.conf. The above won't work. You can't just add the User-Name line in the rlm_ldap configuration and expect it to work. You can either use rlm_attr_rewrite to strip the 'host/' part, or probably add a Hint variable in the users file and use that as the filter: --users-- DEFAULT User-Name =~ "^([^/]+)/(.*)", Hint := `%{2}` --radiusd.conf-- ldap { filter = "(cn=%{check:Hint})" ... } > > Is that possible or am I completely misunderstanding variables.txt ? > I'm running FreeRADIUS built from CVS as of 4/21/04. > > Thanks, > Craig > > PS Forgive the wandering nature of this e-mail, 12+ hours at work... > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Kostas Kalevras Network Operations Center [EMAIL PROTECTED] National Technical University of Athens, Greece Work Phone: +30 210 7721861 'Go back to the shadow' Gandalf - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Kostas Kalevras wrote: The above won't work. You can't just add the User-Name line in the rlm_ldap configuration and expect it to work. I didn't expect it to just work, but I wanted to at least try something before posting a question. The documentation isn't as clear as your answer so I was grasping at straws. You can either use rlm_attr_rewrite to strip the 'host/' part, or probably add a Hint variable in the users file and use that as the filter: --users-- DEFAULT User-Name =~ "^([^/]+)/(.*)", Hint := `%{2}` --radiusd.conf-- ldap { filter = "(cn=%{check:Hint})" ... } I tried adding the expression to the users file as you suggest - that doesn't appear to work either. I still end up with a cn='' filter. Any other ideas are greatly appreciated. Thanks, Craig - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
On Wed, 5 May 2004, Craig Huckabee wrote: > > > Kostas Kalevras wrote: > > > > > The above won't work. You can't just add the User-Name line in the rlm_ldap > > configuration and expect it to work. > > I didn't expect it to just work, but I wanted to at least try something > before posting a question. The documentation isn't as clear as your > answer so I was grasping at straws. > > > > > > You can either use rlm_attr_rewrite to strip the 'host/' part, or probably add > > a Hint variable in the users file and use that as the filter: > > > > --users-- > > DEFAULT User-Name =~ "^([^/]+)/(.*)", Hint := `%{2}` > > > > --radiusd.conf-- > > ldap { > > filter = "(cn=%{check:Hint})" > > ... > > } > > > > > > I tried adding the expression to the users file as you suggest - that > doesn't appear to work either. I still end up with a cn='' filter. Any > other ideas are greatly appreciated. The other idea is to use attr_rewrite as already suggested. In any case, make sure that the files module comes before ldap in the authorize section for the above to work. > > Thanks, > Craig > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Kostas Kalevras Network Operations Center [EMAIL PROTECTED] National Technical University of Athens, Greece Work Phone: +30 210 7721861 'Go back to the shadow' Gandalf - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Kostas Kalevras wrote: The other idea is to use attr_rewrite as already suggested. In any case, make sure that the files module comes before ldap in the authorize section for the above to work. attr_rewrite works but breaks EAP for me :( I've reattempted using the users file again, and double checked that files does indeed come before the ldap sections in the authorize section - still get a blank filter. A debug run shows that files is indeed getting processed, somehow 'Hint' is never getting set. Could my regex be wrong ? DEFAULT User-Name =~ "^([^/]+)/(.*)", Hint := `%{2}` Fall-Through = yes Thanks, Craig - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Another data point - Trying to follow the examples given in variables.txt and using the 'users' file, things like: DEFAULT User-Name =~ "^([^/]+)/(.*)", Everything = `%{0}`, Test-Variable = `%{2}`, Fall-Through = yes causes a core dump on startup. --Craig - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Craig Huckabee <[EMAIL PROTECTED]> wrote: >Trying to follow the examples given in variables.txt and using the > 'users' file, things like: > > DEFAULT User-Name =~ "^([^/]+)/(.*)", > Everything = `%{0}`, > Test-Variable = `%{2}`, > Fall-Through = yes > > causes a core dump on startup. Cute. I've fixed it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Craig Huckabee wrote: attr_rewrite works but breaks EAP for me :( I've reattempted using the users file again, and double checked that files does indeed come before the ldap sections in the authorize section - still get a blank filter. A debug run shows that files is indeed getting processed, somehow 'Hint' is never getting set. Could my regex be wrong ? DEFAULT User-Name =~ "^([^/]+)/(.*)", Hint := `%{2}` Fall-Through = yes Just to follow up to myself, here is the behavior I'm seeing (using FreeRADIUS built from CVS yesterday to include Alan's fix - thanks!) If I use this in the users file: DEFAULT User-Name =~ "^([^/]+)/(.*)", Foo := `%{2}` ... then attempt to look at Foo using %{check:Foo} (in radiusd.conf), I get nothing - Foo is empty. However, if I use this: DEFAULT User-Name =~ "^([^/]+)/(.*)" Foo = `%{2}` ... then attempt to look at Foo using %{reply:Foo}, I get the expected value and the filter works. (note Foo is defined in the dictionary as a custom attribute, wasn't 100% sure if that was required - using Hint yielded the same results) So, should 'check:' work for the first case ? Is this a bug or (more likely) something I'm missing from my configuration. Thanks in advance and also thanks for the patience while I learn the ins and outs of the configuration. --Craig - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Confused by doc/variables.txt
Craig Huckabee <[EMAIL PROTECTED]> wrote: > However, if I use this: > > DEFAULT User-Name =~ "^([^/]+)/(.*)" > Foo = `%{2}` > ... > > then attempt to look at Foo using %{reply:Foo}, I get the expected value > and the filter works. Try the original, but look for foo in %{Foo}, or %{request:Foo} Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html