Radius Administration

[robert_w_brandt]

I also see that freeradius has the ability to query group membership, but the problem is that it assumes that the member attribute is only populated by the username, NOT the full context! Any attempt to modify the ldap filter for something like (member=cn=%{User-Name},*) fails.

I found the answer on another forum. Turns out the documentation for freeradius is incorrect. You need to use this syntax in the LDAP module definition:

groupname_attribute = cn
groupmembership_filter = "(&(objectClass=groupOfNames)(member=%{control:LDA P-UserDn}))"
groupmembership_attribute = groupMembership

I am still having issues with iManager Administration end of it, but for now using the groupmembership allows me to define the reply-attributes in the users files.

Bob