Re: Conditionals in LDAP

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Thursday 02 October 2008 07:53:23 Tom Cooper wrote:
> Hi all,
> I am fairly new to OpenLDAP and I was requested to set up the following:
>
> We have ADSL users to authenticate on freeradius which reads the user
> info via an OpenLDAP server. Now when the user has used a certain amount
> of data he must be flagged as blocked. His connection is disconnected
> and upon reconnection he is assigned a different IP address with
> restricted connectivity untile he tops up his account. I can see that
> his information needs to be changed in LDAP

Not necessarily. There is no need to do authorization via LDAP just because 
you do authentication via LDAP (and, I assume, you won't be doing accounting 
by LDAP either, and your authorization seems to be linked to your accounting 
anyway).

> to maybe assign him to a
> different uid,

Why change the UID? The User-Name returned by your RADIUS server does not 
determine (I assume) that he has restricted connectivity, so there is no point 
in changing the UID (or the DN for that matter). You merely need to have the 
RADIUS server send the appropriate attributes (which could be stored in LDAP 
on the user's entry, or in LDAP on an entry the user is a "member" of, or 
could be the result of authorization via something other than LDAP). However, 
these details are specific to the RADIUS server (and mosty off-topic on an 
LDAP list).

> something like this:
>
> uid=xxxxxx,dc=radius,dc=example,dc=com (Original)
> changed to
> uid=xxxxxx,dc=blocked,dc=radius,dc=example,dc=com.
>
> My question is now how do I accomplish this, because on the client side
> he will still try to authenticate as
> uid=xxxxxx,dc=radius,dc=example,dc=com and I can not control what
> credentials are sent?

You seem to be assuming that DIT structure is a simple concatenation of 
strings. A subtree search dc=radius,dc=example,dc=com would find both of the 
entries above.

However, in general it makes very little sense to move entries around the DIT 
when you could be better served by modifying attributes on the entry instead.

> Is it maybe better accomplished from freeradius than from LDAP? The
> record needs to be changed in LDAP for our admin portal to make use of
> this to check the client's status.

But not necessarily by changing the DN or the naming attributes ...

However, maybe you should get a quote for a VISP from us instead :-P.

Regards,
Buchan