Rewrite Module Configuration; Table 64 Rewrite Module Configuration Settings - Aruba Networks PowerConnect W Clearpass 100 Software Deployment Manual

Table 63 LDAP Module Settings (Continued)
Setting
ldap.groupmembership_filter = not set
ldap.groupmembership_attribute = not set

Rewrite Module Configuration

The attr_rewrite module can be used to perform pattern matching and replacement tasks on RADIUS
attributes contained in an Access-Request message.
See "Server Configuration"
module.
Multiple attr_rewrite modules can be declared. Use the syntax to create an attr_rewrite module named
name:
module.attr_rewrite.name.attribute = "..."
module.attr_rewrite.name.searchin = packet
module.attr_rewrite.name.searchfor = "..."
module.attr_rewrite.name.replacewith = "..."
Use this syntax to instantiate the modules, and specify the numerical order in which the processing should
be done (0, 1, 2, etc.):
authorize.after_preprocess.0.name = module1
authorize.after_preprocess.1.name = module2
The following table describes the rewrite module attributes and settings.

Table 64 Rewrite Module Configuration Settings

Value
module.attr_rewrite.name.attribute = not set
module.attr_rewrite.name.searchin = packet
498 | Reference
Description
The filter to search for group membership of a particular user after
we have found the DN for the group.
Example filter:
(|(&(objectClass=GroupOfNames)(member=%{Ldap-
UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=
%{Ldap-UserDn})))
The attribute in the user entry that states the group the user
belongs to. The attribute can either contain the group name or the
group DN. If it contains the group DN, groupmembership_attribute
will also be used to find the group's name.
The attribute will be used after a search based on the
groupname_attribute and groupmembership_filter has failed. If
unset, the module does not search for a group based on attributes
in the user entry.
in the RADIUS Services chapter for examples showing how to use the attr_rewrite
Description
Specifies the name of the RADIUS attribute for which rewriting
will be performed.
Specifies which attribute list is to be searched: may be
"packet", "reply", "proxy", "proxy_reply" or "config".
The default of "packet" indicates the Access-Request
message; use a value of "reply" to rewrite attributes in either
the Access-Accept or Access-Reject message.
ClearPass Guest 3.9 | Deployment Guide