I have install openldap to authenticate users on system Unix. So, I use the module pam_ldap / nss_ldap with primitive pam_check_host_attr yes, and I have the attribute host for each person in my LDAP. I want to have 3 levels of authentication :
- First level : a person have numerous attributes « host » so he is able to authenticate on these hosts
- Second level : a person could be able to authenticate on a group of host
- Third level : a person is able to authenticate on all hosts
For the first level, for each host I declare one primitive « host » for my user in openldap :
dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr
cn: Francois MEHAULT
For the third level, I put just the primitive « host : * »
But I don’t know how i could do the second level. I would like something like groupRadiusName, I want to define numerous group with host primitive, and each users can be in one group or plus.
The goal is that my user have his host primitive plus the host primitive of his group. Is it possible ?
Thanks for your help,