Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-ID = "17"

$ ldapsearch -H ldaps://{your_domain}.ldap.okta.com:636 \
-D "uid=freeradius@test.com,ou=users,dc=cio-sso,dc=okta,dc=com" \
-W -v -b dc={your_domain},dc=okta,dc=com uid="test@test.com"
ldap_initialize( ldaps://{your_domain}.ldap.okta.com:636/??base )
Enter LDAP Password:
filter: uid=test@test.com
requesting: All userApplication attributes
# extended LDIF
#
# LDAPv3
# base <dc=cio-sso,dc=okta,dc=com> with scope subtree
# filter: uid=test@test.com
# requesting: ALL
#

# test@test.com, users, cio-sso.okta.com
dn: uid=test@test.com,ou=users,dc=cio-sso,dc=okta,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: test@test.com
uniqueIdentifier: 00uoyjiu7vq6NCf8h697
organizationalStatus: ACTIVE
givenName: test
sn: test
cn: test test
mail: test@test.com
division: test_div
displayName: test
o: test_org
title: Crew
department: test_department

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

## 설치
$ brew install freeradius-server
$ cd /opt/homebrew/Cellar/freeradius-server/3.2.7/etc/raddb/

## ldap module 활성화
$ cd mods-enabled; ln -s ../mods-available/ldap

ldap {
    # okta ldap interface, 질의 수행할 ldap 유저 정보, 
    # 해당 유저는 패스워드만으로 로그인 가능해야 함
+	server = 'ldaps://{your_domain}.ldap.okta.com'
+	identity = 'uid=freeradius@test.com,ou=users,dc=cio-sso,dc=okta,dc=com'
+	password = Test123!@#

+	base_dn = 'dc=cio-sso, dc=okta, dc=com'

	sasl { # 필요없음
	}
    
    # 해당 구문을 통해 LDAP Attribute 를 Radius Attribute 에 매핑할 수 있습니다.
    # 구문순서 : <radius attr> <op (=, :=, +=, -=)> <ldap attr>
    # Radius Attribute list : https://www.iana.org/assignments/radius-types/radius-types.xhtml
+	update {
+		# Reply-Message 에 division 정보를 추가합니다. (위 예시의 값은 Platform)
+		reply:Reply-Message := 'division'
+	}



    # 여기서부터는 기존파일 변경필요 X
	user_dn = "LDAP-UserDn"

	user {
		base_dn = "${..base_dn}"
        # 해당 필터 기반으로 ldap 에서 유저를 검색합니다.
        # uid=Stripped-User-Name 존재시 Stripped-User-Name, 없을시 User-Name
		filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

		sasl {
		}
	}
...

authorize {
...
-# -ldap 
+ -ldap 
	#  ldap bind user 로 옥타를 통해 인증하기 위해 다음을 추가합니다
	#  If you're using Active Directory and PAP, then uncomment
	#  the following lines, and the "Auth-Type LDAP" section below.
	#
	#  This will let you do PAP authentication to AD.
	#
-	#if ((ok || updated) && User-Password && !control:Auth-Type) {
-	#	update control {
-	#		&Auth-Type := ldap
-	#	}
-	#}
+	if ((ok || updated) && User-Password && !control:Auth-Type) {
+		update control {
+			&Auth-Type := ldap
+		}
+	}
...

#  Post-Authentication
#  Once we KNOW that the user has been authenticated, there are
#  additional steps we can take.
post-auth {
+ # 인증성공시, Reply-Message 를 기반으로 VLAN 할당에 필요한 Attribute 을 추가합니다
+ if (reply:Reply-Message == "test_div") {
+     update reply {
+         Tunnel-Type := "VLAN"
+         Tunnel-Medium-Type := "IEEE-802"
+         Tunnel-Private-Group-ID := "17"
+     }
+ }

...

$ radiusd -X : 라디우스 서버 디버그모드 실행


# radclient [options] server[:port] <command> [<secret>]
#시크릿은 테스트용, raddb/clients.conf client 안에 secret 명시가능
$ radclient -f test -t 20 127.0.0.1:1812 auth testing123

-----
test 파일(supplicant 의 Auth-Request) : 
User-Name=test@test.com
User-Password="QWEqwe123@"

User-Password="testPassword,push" 쓰면 okta verify push mfa 도 가능함

...

#  Post-Authentication
#  Once we KNOW that the user has been authenticated, there are
#  additional steps we can take.
post-auth {
  # 인증성공시, Reply-Message 를 기반으로 VLAN 할당에 필요한 Attribute 을 추가합니다
- if (reply:Reply-Message == "test_div") {
-     update reply {
-         Tunnel-Type := "VLAN"
-         Tunnel-Medium-Type := "IEEE-802"
-         Tunnel-Private-Group-ID := "17"
-     }
- }

...

authorize {
...
-# -ldap 
+ -ldap 
	#  ldap bind user 로 옥타를 통해 인증하기 위해 다음을 추가합니다
	#  If you're using Active Directory and PAP, then uncomment
	#  the following lines, and the "Auth-Type LDAP" section below.
	#
	#  This will let you do PAP authentication to AD.
	#
-	#if ((ok || updated) && User-Password && !control:Auth-Type) {
-	#	update control {
-	#		&Auth-Type := ldap
-	#	}
-	#}
+	if ((ok || updated) && User-Password && !control:Auth-Type) {
+		update control {
+			&Auth-Type := ldap
+		}
+	}
...

#  Post-Authentication
#  Once we KNOW that the user has been authenticated, there are
#  additional steps we can take.
post-auth {
+ # 인증성공시, Reply-Message 를 기반으로 VLAN 할당에 필요한 Attribute 을 추가합니다
+ if (reply:Reply-Message == "test_div") {
+     update reply {
+         Tunnel-Type := "VLAN"
+         Tunnel-Medium-Type := "IEEE-802"
+         Tunnel-Private-Group-ID := "17"
+     }
+ }

	######  중요! inner-tunnel 의 reply 를 outer 로 업데이트하여,
    ######  최종적으로 supplicant 에 전달하기 위해 다음이 반드시 필요합니다.
	#  Instead of "use_tunneled_reply", change this "if (0)" to an
	#  "if (1)".
	#
-	if (0) {
+	if (1) {
		#
		#  These attributes are for the inner-tunnel only,
		#  and MUST NOT be copied to the outer reply.
		#
		update reply {
			User-Name !* ANY
			Message-Authenticator !* ANY
			EAP-Message !* ANY
			Proxy-State !* ANY
			MS-MPPE-Encryption-Types !* ANY
			MS-MPPE-Encryption-Policy !* ANY
			MS-MPPE-Send-Key !* ANY
			MS-MPPE-Recv-Key !* ANY
		}

		#
		#  Copy the inner reply attributes to the outer
		#  session-state list.  The post-auth policy will take
		#  care of copying the outer session-state list to the
		#  outer reply.
		#
		update {
			&outer.session-state: += &reply:
		}
	}

...