* Dynamic expansions have changed from `%{md5:foo}` to `%md5(foo)`.
* The new syntax is much clearer, and supports multiple comma-separated arguments: `%function(a, b, c)`
* Expansions such as `%{User-Name}` will still work. We plan on making `%{1+2}` work, too.
- * We plan on replacing `%{foo:-%{bar}}` by `%{foo || bar}`, which is clearer and uses less nesting.
+ * Alternation `%{%{foo}:-%{bar}}` has been replaced by `%{&foo || &bar}`, which is clearer and uses less nesting.
Please be aware that v4 is in "alpha" right now. If it works, great.
If it doesn't work, then please return to using v3.
# example - ou=people,${..base_dn}
base_dn = "<user.base_dn>" <1>
- # example - (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}}))
- filter = "(&(<user.filter>)(<user_uid_attribute>=%{%{Stripped-User-Name}:-%{User-Name}}))" <2>
+ # example - (&(objectClass=posixAccount)(uid=%{&Stripped-User-Name || &User-Name}))
+ filter = "(&(<user.filter>)(<user_uid_attribute>=%{&Stripped-User-Name || &User-Name}))" <2>
}
}
----
# example - base_dn = "ou=people,${..base_dn}"
base_dn = "<path_from_base_dn_to_user_obj_dn>,${..base_dn}" <5>
- # example = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=posixAccount))"
- filter = "(&(<user_uid_attribute>=%{%{Stripped-User-Name}:-%{User-Name}})(<user_filter>))" <6>
+ # example = "(&(uid=%{&Stripped-User-Name || &User-Name)(objectClass=posixAccount))"
+ filter = "(&(<user_uid_attribute>=%{&Stripped-User-Name || &User-Name)(<user_filter>))" <6>
}
}
----
|===
| Purpose | `ldap { user { ... } }` config item
| Specify where to search for users | ```base_dn = '<user_base_dn>'```
-| Specify how to find a user | ```filter = "(&(<user_filter>)(<user_uid_attribute>=%{%{Stripped-User-Name}:-%{User-Name}})"```
+| Specify how to find a user | ```filter = "(&(<user_filter>)(<user_uid_attribute>=%{&Stripped-User-Name || &User-Name)"```
| Retrieve a "known good" password | ```&control.Password.With-Header = <user_password_attribute>```
| Allow accounts to be explicitly disabled | ```access_attribute = '<user_access_disabled_attribute>'``` +
```access_positive = 'no'```
[width="100%",cols="30%,70%",options="header",]
|===
| Purpose | `ldap { group { ... } }` config item
-| Specify how to find group objects referencing a user by name. | ```membership_filter = "(<group_membership_uid_attribute>=%{%{Stripped-User-Name}:-%{User-Name}})"```
+| Specify how to find group objects referencing a user by name. | ```membership_filter = "(<group_membership_uid_attribute>=%{&Stripped-User-Name || &User-Name)"```
|===
.Mixing and matching group membership schemes
[source,config]
----
-membership_filter = "(|(<group_membership_filter_by_uid>=%{control.Ldap-UserDn})(<group_membership_filter_by_name>=%{%{Stripped-User-Name}:-%{User-Name}}))"
+membership_filter = "(|(<group_membership_filter_by_uid>=%{control.Ldap-UserDn})(<group_membership_filter_by_name>=%{&Stripped-User-Name || &User-Name))"
----
****
# initial data to send
# this MUST be supplied
ntlm_auth_username = "username: %(mschap:User-Name)"
- ntlm_auth_domain = "nt-domain: %{%(mschap:NT-Domain):-YOURDOMAIN}"
+ ntlm_auth_domain = "nt-domain: %{%(mschap:NT-Domain) || 'YOURDOMAIN'}"
# Or, you could try:
ntlm_auth_username = "full-username: %{User-Name}"
nasipaddress = '', \
pool_key = 0, \
expiry_time = NOW() \
- WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}' \
+ WHERE nasipaddress = '%{&NAS-IP-Address || &NAS-IPv6-Address}' \
AND pool_key = '${pool_key}' \
AND username = '%{User-Name}' \
AND callingstationid = '%{Calling-Station-Id}' \
nasipaddress = '', \
pool_key = 0, \
expiry_time = NOW() \
- WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'"
+ WHERE nasipaddress = '%{&NAS-IP-Address || &NAS-IPv6-Address}'"
...
----
counter_name = &control.Daily-Session-Time
check_name = &control.Max-Daily-Session
reply_name = &reply.Session-Timeout
-key = "%{%{Stripped-User-Name}:-%{User-Name}}"
+key = "%{&Stripped-User-Name || &User-Name}"
```
Just adding the `&` prefix to the attribute name is not sufficient.
functionality, the key should now be specified as a dynamic expansion:
```
-key = "%{%{Stripped-User-Name}:-%{User-Name}}"
+key = "%{&Stripped-User-Name || &User-Name}"
```
The `count_attribute` has been removed, as it is no longer necessary.
--------------------------------------------------------------------
detail byname {
- filename = ${radacctdir}/byname/%{%{User-Name}:-none}
+ filename = ${radacctdir}/byname/%{&User-Name || 'none'}
permissions = 0600
}