<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Verdana",sans-serif;
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">Hi folks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">Question:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">I want to allow only authorized people to access specific NASes. And the authorization needs to come from Active Directory (LDAP2).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">Obviously, I have access to NAS-IP-Address coming in from the Access-Request. The problem is that our AD organizes authorized staff into groups which are presented using the “memberOf”
attribute. When I fetch that from AD, someone like me who belongs to multiple groups gets an ugly mess that looks like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">07715580 Fri Feb 11 17:03:48 2022 710905: DEBUG: LDAP got memberOf: CN=Development Team,CN=Users,DC=MYDOMAIN,DC=mycompany,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">DC=com CN=OUC,CN=Users,DC=MYDOMAIN,DC=mycompany,DC=com CN=My Engineering,CN=Users,DC=MYDOMAIN,DC=mycompany,DC=com CN=My Alarms,CN=Users,DC=MYDOMAIN,DC=mycompany,DC=com CN=Admin Access,CN=Users,DC=MYDOMAIN,DC=mycompany,DC=com
CN=All Staff,CN=<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">Users,DC=MYDOMAIN,DC=mycompany,DC=com CN=Management List,CN=Users,DC=MYDOMAIN,DC=mycompany,DC=com CN=Graphic Developme<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">nt,CN=Users,DC=MYDOMAIN,DC=mycompany,DC=com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">The only part that tells me I have access to a particular NAS is the “Admin Access” entry. I could just do a clumsy regex to look for a match. But the documentation:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><a href="https://www.open.com.au/radiator/ref/AuthAttrDef_AuthByLDAP2.html#Host_AuthByLDAP2-24">https://www.open.com.au/radiator/ref/AuthAttrDef_AuthByLDAP2.html#Host_AuthByLDAP2-24</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">says something about support for multi-valued LDAP attributes. But I don’t understand the data structure; I can’t seem to parse on commas or spaces. Does this type of data qualify
for the “multi-valued” parsing that is advertised in the documentation? In other words, if I did a check for “DC=com CN=Admin Access”, would it find a match?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">So, the second part of my problem is that obviously “DC=com CN=Admin Access” won’t match the NAS-IP-Address. What I really need is logic like:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">IF AD.memberOf(user) matches “DC=com CN=Admin Access” AND NAS-IP-Address = A.B.C.D<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">THEN PASS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">ELSE IF AD.memberOf(user) matches “DC=com CN=Regular Access” AND NAS-IP-Address = W.X.Y.Z<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">THEN PASS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">ELSE FAIL<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">Guidance on how to solve this problem is greatly appreciated!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue">Dave<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:blue"><o:p> </o:p></span></p>
</div>
CONFIDENTIALITY NOTICE***The information contained in this message may be privileged, confidential, and protected from disclosure. If the reader of this message is not the intended recipient, or any employee or agent responsible for delivering this message
to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and
deleting it from your computer. Thank you.
</body>
</html>