I would like to dynamically assign VLANs to users using control:Tunnel-Private-Group-ID += ‘radiusTunnelPrivategroupId’. control:Tunnel-Private-Group-ID is a list that contains the VLANs of which the user is a member. I used a configuration that works well if we are local. but does not work if the request comes from the router. It shows this error “No attributes updated for RHS &control:Tunnel-Private-Group-ID[1]”

thank you in advance for your help

here is the configuration to use:

here is the configuration to use:

nano /etc/freeradius/3.0/mods-enabled/ldap


 update {
                control:Password-With-Header    += 'userPassword'
#               control:Cleartext-Password      += 'userPassword'
#               control:NT-Password             := 'ntPassword'
#               reply:Reply-Message             := 'radiusReplyMessage'
                reply:Tunnel-Type               := 'radiusTunnelType'
                reply:Tunnel-Medium-Type        := 'radiusTunnelMediumType'
                control:Tunnel-Private-Group-ID   += 'radiusTunnelPrivategroupId'
                control:My_Group                += 'radiusTunnelPrivategroupId'

                #  Where only a list is specified as the RADIUS attribute,
                #  the value of the LDAP attribute is parsed as a valuepair
                #  in the same format as the 'valuepair_attribute' (above).
                control:                        += 'radiusControlAttribute'
                request:                        += 'radiusRequestAttribute'
                reply:                          += 'radiusReplyAttribute'
        }
----------------------------------------------------------------------------------------------


nano /etc/freeradius/3.0/sites-enabled/default


if (&NAS-Identifier =~ /swstage-2300/) {

                        update reply {
                                 Tunnel-Type = VLAN
                                 Tunnel-Medium-Type = IEEE-802
                                 Tunnel-Private-Group-ID = &control:Tunnel-Private-Group-ID[0]
                            }

        } else {
                 update reply {
                                 Tunnel-Type = VLAN
                                 Tunnel-Medium-Type = IEEE-802
                                 Tunnel-Private-Group-ID = &control:Tunnel-Private-Group-ID[1]
                }

        }
-------------------------------------------------------------------------------------------

sudo freeradius -X
...



(10) ldap: Performing search in "dc=kervao,dc=fr" with filter "(uid=mdoe)", scope "sub"
(10) ldap: Waiting for search result...
(10) ldap: User object found at DN "cn=Martin Doe,ou=Users,dc=kervao,dc=fr"
(10) ldap: No cacheable group memberships found in user object
(10) ldap: EXPAND (&(objectClass=groupOfNames)(|(member=%{control:LDAP-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})))
(10) ldap:    --> (&(objectClass=groupOfNames)(|(member=cn3dMartin Doe2cou3dUsers2cdc3dkervao2cdc3dfr)(memberUid=mdoe)))
(10) ldap: Performing search in "dc=kervao,dc=fr" with filter "(&(objectClass=groupOfNames)(|(member=cn3dMartin Doe2cou3dUsers2cdc3dkervao2cdc3dfr)(memberUid=mdoe)))", scope "sub"
(10) ldap: Waiting for search result...
(10) ldap: Adding cacheable group object memberships
(10) ldap:   &control:LDAP-Group += "cn=IT,ou=Groupes,dc=kervao,dc=fr"
(10) ldap:   &control:LDAP-Group += "IT"
(10) ldap: Processing user attributes
(10) ldap: control:Password-With-Header += 'password123'
(10) ldap: reply:Tunnel-Type := VLAN
(10) ldap: reply:Tunnel-Medium-Type := IEEE-802
(10) ldap: control:Tunnel-Private-Group-ID += '40'
(10) ldap: control:Tunnel-Private-Group-ID += '400'
(10) ldap: control:My_Group += '40'
(10) ldap: control:My_Group += '400'
rlm_ldap (ldap): Released connection (4)
(10)       [ldap] = updated
(10)       [expiration] = noop
(10)       [logintime] = noop


...

(11) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default
(11)   post-auth {
(11)     if (&NAS-Identifier =~ /swstage-2300/) {
(11)     if (&NAS-Identifier =~ /swstage-2300/)  -> TRUE
(11)     if (&NAS-Identifier =~ /swstage-2300/)  {
(11)       update reply {
(11)         Tunnel-Type = VLAN
(11)         Tunnel-Medium-Type = IEEE-802
(11)         No attributes updated for RHS &control:Tunnel-Private-Group-ID[0]
(11)       } # update reply = noop
(11)     } # if (&NAS-Identifier =~ /swstage-2300/)  = noop
(11)     ... skipping else: Preceding "if" was taken
(11)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(11)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(11)     update {
(11)       &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) recv TLS 1.3 Handshake, ClientHello'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, ServerHello'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, Certificate'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, ServerKeyExchange'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, ServerHelloDone'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) recv TLS 1.2 Handshake, ClientKeyExchange'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) recv TLS 1.2 Handshake, Finished'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 ChangeCipherSpec'
(11)       &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, Finished'
(11)       &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384'
(11)       &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2'
(11)     } # update = noop
(11) sql: EXPAND .query


(11) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (2)
(11) sql: EXPAND %{User-Name}
(11) sql:    --> mdoe
(11) sql: SQL-User-Name set to 'mdoe'
(11) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )
(11) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'mdoe', '', 'Access-Accept', '2024-05-13 16:34:40.783330' )
(11) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'mdoe', '', 'Access-Accept', '2024-05-13 16:34:40.783330' )
(11) sql: SQL query returned: success
(11) sql: 1 record(s) updated
rlm_sql (sql): Released connection (2)
(11)     [sql] = ok
(11)     [exec] = noop
(11)     policy remove_reply_message_if_eap {
(11)       if (&reply:EAP-Message && &reply:Reply-Message) {
(11)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(11)       else {
(11)         [noop] = noop
(11)       } # else = noop
(11)     } # policy remove_reply_message_if_eap = noop
(11)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(11)     if (EAP-Key-Name && &reply:EAP-Session-Id)  -> FALSE
(11)   } # post-auth = ok
(11) Sent Access-Accept Id 141 from 10.1.127.1:1812 to 10.1.127.4:49859 length 184
(11)   Tunnel-Type := VLAN
(11)   Tunnel-Medium-Type := IEEE-802
(11)   User-Name = "mdoe"
(11)   MS-MPPE-Recv-Key = 0x5d87d2f8c977f13f46e9f9f56bff6cf380b0d9e24f7efea95cc03e6ce6f0d6ae
(11)   MS-MPPE-Send-Key = 0xb82a5f4b856b489f4ff85d7b26bf26803308b9227d5d3bcdd02f0fb9756fcbef
(11)   EAP-Message = 0x03090004
(11)   Message-Authenticator = 0x00000000000000000000000000000000
(11)   Framed-MTU += 994
(11) Finished request
Waking up in 4.7 seconds.
(2) Cleaning up request packet ID 132 with timestamp +48 due to cleanup_delay was reached
(3) Cleaning up request packet ID 133 with timestamp +48 due to cleanup_delay was reached
(4) Cleaning up request packet ID 134 with timestamp +48 due to cleanup_delay was reached
(5) Cleaning up request packet ID 135 with timestamp +48 due to cleanup_delay was reached
(6) Cleaning up request packet ID 136 with timestamp +48 due to cleanup_delay was reached
(7) Cleaning up request packet ID 137 with timestamp +48 due to cleanup_delay was reached
(8) Cleaning up request packet ID 138 with `your text`timestamp +48 due to cleanup_delay was reached
(9) Cleaning up request packet ID 139 with timestamp +48 due to cleanup_delay was reached
(10) Cleaning up request packet ID 140 with timestamp +48 due to cleanup_delay was reached
(11) Cleaning up request packet ID 141 with timestamp +48 due to cleanup_delay was reached
Ready to process requests