I am wondering if variables other than <USER> and <GROUP> can be used in
search filters when configuring an ldap server.
I have a sign-in policy using a realm that is configured for 802.1x certificate
authentication. The ldap configuration is used for authorization. I want to
confirm that the mac address of the client is the same as the mac address stored
in ldap.
I know that the mac address of the client is being sent during authentication
as a Calling-Station-ID radius attribute.
I would like my filter to look something like:
__(&(objectClass=ieee802Device)(cn=<USER>)(macAddress=<Calling-Station-Id>))_
Is there a way to use the radius attributes from authentication in the ldap authorization
filter? Better yet, is the mac address available in a nice preformatted form?
