On Mon, 15 Mar 2004, Tariq Rashid wrote:
i've previously used radiator as it is simple to modify the check and reply
items, especially when the check and reply items depend on some quite
convoluted logic (the flowchart is not simple).
having had an initial look at freeradius and the ldap module - i am reaching
the conclusion that the standard modules and freeradius are not suited to
this task. for simple tasks such as always adding ldap attributes to reply
packets then freeradius seems to be fine. there appears to be no easy way to
encode any complex decision logic in the configuration files.
(for example, is domain is xxx and dialled number is one of a, b, c or d,
then get ldap attributes and add to reply. another example could be if ldap
attribute exists, then proceed with logic block)...
You can accomplish most things with multiple ldap module instances, the
Ldap-Profile attribute, ldap xlat, and Autz-Type. I don't think the ldap module
should get more complicated, just use the already existing general
infrastructure. doc/rlm_ldap should clear most of the above things.
If you can find a specific need which can't be handled by such a mechanism then
we can talk about changes to the ldap module.
the only sensible location for non-trivial decision logic is in a new module
specific to our needs. but would this mean that we have to implement our own
calls to ldap within this module, or could we use the existing ldap module
to get the relevent attributes and then use these values on our own module?
that is ...
{
call standard ldap module;
...
call our module (which uses values retrieved)
...
}
even my initial look at the ldap module was confusing as the exmaples simpy
connect to the ldap server using the supplied usernamer and password. this
is not what i want, i want to connect using a standard signle username and
use the supplied User-Name to obtain various records...
This is wrong, the ldap module will connect with the supplied username/password
for user authentication. Use authorization (ldap attributes extraction) is
performed by connecting to the ldap server with the username/password specified
in the module configuration
thoughts, comments appreciated
tariq
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--
Kostas Kalevras Network Operations Center
[EMAIL PROTECTED] National Technical University of Athens, Greece
Work Phone: +30 210 7721861
'Go back to the shadow' Gandalf
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
