Yubico Forum

Hi All,
I've been trying to configure the YubiRaius 3.6.1 to return Vendor Specific Attributes ( VSA ) with no success.
Has anyone succesfully configure Yubiradius to return VSA at all ?
if yes can you share which config file that I need to configure ?

Thanks,
Alberto

I've got this working by adding the attributes in the /etc/freeradius/users file and adding the dictionary under /usr/share/freeradius/
DEFAULT Auth-Type = pap
PaloAlto-Admin-Role = "superuser",
PaloAlto-User-Group = "VPNgroup",
Service-Type = Login-User

---------------------
Dictionary file

VENDOR PaloAlto 25461
BEGIN-VENDOR PaloAlto
ATTRIBUTE PaloAlto-Admin-Role 1 string
ATTRIBUTE PaloAlto-Admin-Access-Domain 2 string
ATTRIBUTE PaloAlto-Panorama-Admin-Role 3 string
ATTRIBUTE PaloAlto-Panorama-Admin-Access-Domain 4 string
ATTRIBUTE PaloAlto-User-Group 5 string
END-VENDOR PaloAlto

You'll have to add a vendor dictionary to freeradius's dictionary files /usr/share/freeradius/ (if I recall correctly) and make sure the vendor dictionary is configured to load in the /usr/share/freeradius/dictionary file using $INCLUDE dictionary.vendorxyz and restart freeradius.

I used the ldap mapping /etc/freeradius/ldap.attr to map my vendor attributes to the ldap attribute which I chose. It helps to run freeradius in debug mode to troubleshoot. You run debug mode using the following freeradius -X. The catch is this is debian and there is a bug so you actually have to run this command instead LD_PRELOAD=/usr/lib/libperl.so.5.10 freeradius -X.

Here some info about the bug http://www.packetfence.org/bugs/view.ph ... &history=1


Hopefully that helps you. I spent quite a bit of time figuring it out and still have lots to learn.

Hi , thanks for the reply,
do you have any example for the ldap.attrmap config ?
Do I also need to enable the ldap setting in sites-enabled/default ?

Thanks