<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hello Hugh,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I have noticed the existence of "deref" parameter, but no one is designed to specify what extended attribute you want to get from the dereferenced ones.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">In the following example, an object of class
<span>oscradiusclient</span> contains an attribute "memberof" which is actually a reference to another object (aka a DN).<br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">when you run an extended search to get attribute "radiusReplyItem" from the referenced attribute memberof:<br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div></div>
<div>ldapsearch -Y GSSAPI -E 'deref=memberof:radiusReplyItem' '(objectclass=oscradiusclient)' control memberof</div>
<div><br>
</div>
<div>You get:</div>
<div><br>
# LDAPv3<br>
# base <SUFFIX> (default) with scope subtree<br>
# filter: (&(objectclass=oscradiusclient2))<br>
# requesting: control<br>
# with dereference control<br>
<div><br>
</div>
<div>
<div># ipa2.pp-iam.mycorp.net, computers, accounts, pp-iam.mycorp.net<br>
dn: fqdn=ipa2.pp-iam.mycorp.net,cn=computers,cn=accounts,SUFFIX<br>
</div>
<br>
</div>
<div>memberof: ipaUniqueID=UUID1,cn=hbac,SUFFIX<br>
</div>
<div><span>memberof: ipaUniqueID=UUID2,cn=hbac,SUFFIX</span><br>
</div>
control: 1.3.6.1.4.1.4203.666.5.16 false <HERE FOLLOWS A BASE64 ENCODED ANSWER></div>
<div><br>
# memberof: <radiusReplyItem=you are authorized with the integrated iam profile1>;</div>
<div>ipaUniqueID=UUID1,cn=hbac,SUFFIX<br>
<br>
# memberof: <radiusReplyItem=you are authorized with the integrated iam profile2>;</div>
<div>ipaUniqueID=UUID2,cn=hbac,SUFFIX<br>
</div>
<div>
<div><br>
</div>
<br>
</div>
<div>As you can see, the virtual attribute "control" contains all you have requested in the 'deref=' parameter, in a base64 encoded way. The two following
<span>commented </span>lines are merely detailing in a readable form the value of "control".</div>
<div><br>
</div>
<div>BUT… how to search like this in radiator ? The existence of the parameter "deref" suggest that it is possible, my I do not know how to proceed. No keywords listed un section 3.9.23 seems to be designed for that.</div>
<div><br>
</div>
<div>Finally, it would be great if you can add support for postSearchHook in ClientListLDAP as a complement of the above possibility to dereference subordinates DN of a search. Is that a feature we could buy ?<br>
</div>
<div><br>
</div>
<div>Best regards</div>
<div><br>
</div>
<div>Jean-Philippe<br>
</div>
<br>
<p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>De :</b> Hugh Irvine <hugh@open.com.au><br>
<b>Envoyé :</b> samedi 22 septembre 2018 00:54:22<br>
<b>À :</b> AYANIDES, Jean-Philippe<br>
<b>Cc :</b> radiator@lists.open.com.au<br>
<b>Objet :</b> Re: [RADIATOR] LDAP: dereferencing searches</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText"><br>
Salut Jean-Philippe -<br>
<br>
You can use any of the LDAP keywords as listed in section 3.9 of the Radiator 4.21 reference manual (“doc/ref.pdf”).<br>
<br>
See section 3.9.23 Deref for example.<br>
<br>
We could also look at adding support for PostSearchHook in ClientListLDAP if required.<br>
<br>
regards<br>
<br>
Hugh<br>
<br>
<br>
> On 22 Sep 2018, at 01:57, AYANIDES, Jean-Philippe <jpayanides@prosodie.com> wrote:<br>
> <br>
> Hello,<br>
> <br>
> I'd like to use LDAP2 mechanism to get clients attributes from LDAP (with the directive "clientlistldap").<br>
> <br>
> But one of the attribute returned by the ldap search is a DN (syntax 1.3.6.1.4.1.1466.115.121.1.12) I would like to dereference.<br>
> So well, I am looking to the way to dereference that DN, in order to get attributes from the linked object.<br>
> With ldapsearch, I used to run for example:<br>
> <br>
> ldapsearch -Y GSSAPI -E 'deref=memberof:radiusReplyItem' '(serverhostname=myNAS)'
<br>
> <br>
> But with LDAP2, I do not know how to do it. There is no keyword similar to the keyword "filter" designed to add the extending searches...<br>
> Can anyone help me ?<br>
> <br>
> Jean-Philippe<br>
> This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print,
retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message._______________________________________________<br>
> radiator mailing list<br>
> radiator@lists.open.com.au<br>
> <a href="http://lists.open.com.au/mailman/listinfo/radiator">http://lists.open.com.au/mailman/listinfo/radiator</a><br>
<br>
<br>
--<br>
<br>
Hugh Irvine<br>
hugh@open.com.au<br>
<br>
Radiator: the most portable, flexible and configurable RADIUS server <br>
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald, <br>
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS, <br>
TTLS, PEAP, TNC, WiMAX, RSA, Vasco, Yubikey, MOTP, HOTP, TOTP,<br>
DIAMETER, SIM, etc. <br>
Full source on Unix, Linux, Windows, macOS, Solaris, VMS, NetWare etc.<br>
<br>
</div>
</span></font></div>
</body>
</html>