Hi All,

I have install openldap to authenticate users on system Unix. So, I use the module pam_ldap / nss_ldap with primitive pam_check_host_attr yes, and I have the attribute host for each person in my LDAP. I want to have 3 levels of authentication :

- First level : a person have numerous attributes « host » so he is able to authenticate on these hosts

- Second level : a person could be able to authenticate on a group of host

- Third level : a person is able to authenticate on all hosts

For the first level, for each host I declare one primitive « host » for my user in  openldap :

dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr

givenName:: RnJhbsOnb2lz

sn: MEHAULT

uid: fmehault

cn: Francois MEHAULT

homeDirectory: /home/fmehault

loginShell: /usr/local/bin/sh

gidNumber: 1203

uidNumber: 1203

objectClass: inetOrgPerson

objectClass: posixAccount

objectClass: top

objectClass: hostObject

userPassword: {MD5}9x2+UmKKP4OnerSUgXUlxg==

host: labobe1

host: labobe2

For the third level, I put just the primitive « host : * »

But I don’t know how i could do the second level.  I would like something like groupRadiusName, I want to define numerous group with host primitive, and each users can be in one group or plus.

The goal is that my user have his host primitive plus the host primitive of his group. Is it possible ?

Thanks for your help,

Regards,

François