We have the same need and I've written some hooks that do what you want.
We have multiple radiator instances proxying tacacs+ requests to our central
instance with radius.
We use the OSC-Group-Identifier radius attribute for the tacacsgroup on the
outer instances and build the ldap dn from it on the central instance and store
it in a attribute not contained in the dictionary called
OSC-Group-Identifier-LDAP.
Put this in your Handler which contains the AuthBy LDAP2:
PreAuthHook file:"%D/create-osc-group-identifier-ldap.pl"
This in your AuthBy LDAP2 section:
AuthAttrDef memberOf,OSC-Group-Identifier-LDAP,check
Create a file in your radiator directory called
create-osc-group-identifier-ldap.pl with the following contents:
# transforms the OSC-Group-Identifier to the ldap format and store it in
another attribute
sub {
my $p = ${$_[0]};
my $group;
if ($group = $p->get_attr('OSC-Group-Identifier')) {
# that's the current ldap groupname:
# CN=SUPPORT_OUR.GROUP.NAME,OU=_Groups,DC=our,DC=company,DC=at
$group = "CN=SUPPORT_$group,OU=_Groups,DC=our,DC=company,DC=at";
&main::log($main::LOG_DEBUG, "OSC-Group-Identifier-LDAP = $group");
$p->change_attr('OSC-Group-Identifier-LDAP', $group);
}
return;
}
You can verify that the hook is ok by running perl -c $filename.
HTH
--
Regards, Alex
Am Dienstag, den 28.09.2010, 02:00 +0200 schrieb Hugh Irvine:
Hello Waldemar -
If you already know the group from the SearchFilter query, you can just use an
AddToReply like this:
###############################################
<AuthBy LDAP2>
Identifier ASA-Admin
Host w3kvm.adtest.corporate.net
HoldServerConnection
AuthDN cn=radiator,cn=Users,dc=adtest,dc=corporate,dc=net
AuthPassword XXXXX
BaseDN dc=adtest,dc=corporate,dc=net
ServerChecksPassword
UsernameAttr sAMAccountName
SearchFilter
(&(%0=%1)(memberOf=CN=ASAADMINS,DC=adtest,DC=corporate,DC=net))
AddToReply tacacsgroup = ASAADMINS
Debug 255
</AuthBy>
###############################################
<ServerTACACSPLUS>
regards
Hugh
On 27 Sep 2010, at 18:40,
<w.sieb...@t-systems.com<mailto:w.sieb...@t-systems.com>>
<w.sieb...@t-systems.com<mailto:w.sieb...@t-systems.com>> wrote:
> Hello,
>
> I try to implement the mapping of AD groups to TACAS+ groups.
>
> Witch AuthAttrDef memberOf,tacacsgroup,reply will be the complete LDAP string
> delivered:
> tacacsgroup = CN=ASAADMINS,DC=adtest,DC=corporate,DC=net
>
> My question: it is possible to strip all the unnecessary parts to deliver
> "ASAADMINS" only to tacacsgroup?
>
> I read manual and mailinlist diligently, but was not clever.
>
> Thanks for your help
>
>
>
> Here an extract of my config:
> ###############################################
> <AuthBy LDAP2>
> Identifier ASA-Admin
>
> Host w3kvm.adtest.corporate.net
> HoldServerConnection
>
> AuthDN cn=radiator,cn=Users,dc=adtest,dc=corporate,dc=net
> AuthPassword XXXXX
> BaseDN dc=adtest,dc=corporate,dc=net
> ServerChecksPassword
> UsernameAttr sAMAccountName
>
> SearchFilter
> (&(%0=%1)(memberOf=CN=ASAADMINS,DC=adtest,DC=corporate,DC=net))
>
> AuthAttrDef memberOf,tacacsgroup,reply
>
> Debug 255
> </AuthBy>
> ###############################################
> <ServerTACACSPLUS>
> GroupMemberAttr tacacsgroup
>
> AuthorizeGroup ASAADMINS permit service=shell cmd=show
> cmd-arg=.*
> AuthorizeGroup group1 deny .*
> .....................
> </ServerTACACSPLUS>
> ###############################################
>
> Here an extract of my Log:
>
>
> Sun Sep 26 19:27:09 2010: DEBUG: AuthBy LDAP2 result: ACCEPT,
> Sun Sep 26 19:27:09 2010: DEBUG: Access accepted for aduser01
> Sun Sep 26 19:27:09 2010: DEBUG: Packet dump:
> *** Reply to TACACSPLUS request:
> Code: Access-Accept
> Identifier: UNDEF
> Authentic: ,|C<229><152><134><142>p? U<154>qSk<191>
> Attributes:
> tacacsgroup = CN=ASAADMINS,DC=adtest,DC=corporate,DC=net
>
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsplusConnection result Access-Accept
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsplusConnection Authentication REPLY 1,
> 0, ,
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsplusConnection request 193, 2, 2, 0,
> 1234, 79
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsPlus request packet dump:
> c1020200000004d20000004f0e63dedad6576899fad69068509e9bc4dd7fe3edaab83f773ddf0d4679cdadcbca8cd54899138d3cf493fc776e476146108586b5ff3052adcca129fb3fc2b59ca16a8ef718f1f2753f2c136795f90b
> Sun Sep 26 19:27:09 2010: DEBUG: Decrypting TacacsPlus request
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsPlus request decrypted body:
> 0600020015030a030d080d61647573657230314061646d696e732e7265616c6d31323374657374636c69656e74736572766963653d7368656c6c636d643d73686f77636d642d6172673d686f737431
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsplusConnection Authorization REQUEST
> 6, 0, 2, 0, aduse...@admins.realm<mailto:aduse...@admins.realm>, 123,
> testclient, 3, service=shell cmd=show cmd-arg=host1
> Sun Sep 26 19:27:09 2010: INFO: Authorization denied for
> aduse...@admins.realm<mailto:aduse...@admins.realm>, group
> CN=ASAADMINS,DC=adtest,DC=corporate,DC=net. No matching AuthorizeGroup rule
> for args service=shell cmd=show cmd-arg=host1
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsplusConnection Authorization RESPONSE
> 16, denied, ,
> Sun Sep 26 19:27:09 2010: DEBUG: TacacsplusConnection disconnected from
> 10.11.11.2:1786
>
>
> Kind regards
> Waldemar Siebert
>
> T-Systems International GmbH
> Corporate Customers
> Telecommunications Services & Solutions (TSS)
> Technical Engineering (TSS TE) - Security, Production Engineering & Lab
> Dipl.-Ing. Waldemar Siebert
>
>
> _______________________________________________
> radiator mailing list
> radiator@open.com.au<mailto:radiator@open.com.au>
> http://www.open.com.au/mailman/listinfo/radiator
NB:
Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive
(www.open.com.au/archives/radiator<http://www.open.com.au/archives/radiator>)?
Have you had a quick look on Google (www.google.com<http://www.google.com>)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
T-Systems Austria GesmbH Rennweg 97-99, 1030 Wien
Handelsgericht Wien, FN 79340b
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
Notice: This e-mail contains information that is confidential and may be
privileged.
If you are not the intended recipient, please notify the sender and then
delete this e-mail immediately.
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
_______________________________________________
radiator mailing list
radiator@open.com.au
http://www.open.com.au/mailman/listinfo/radiator
