In freeradius, is there a way to refer to LDAP attributes in post-auth section? - ldap

Question

We're using PEAP with mschapv2 using ntlm command line. We want to assign users ip's from LDAP
After we get a reply back from ActiveDirectory, we're doing an authorization check by binding to LDAP and looking at their groups:
post-auth {
if (network-auth-LDAP-Group == "xxxcompany-vpn") {
noop
} else {
reject
}
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
We'd like to pull 10.1.2.3 from an LDAP Attribute. We tried doing what the documentation says by putting this in the LDAP config:
update {
reply:Framed-IP-Address := 'radiusFramedIPAddress'
}
In LDAP, we imported the schema and set radiusFramedIPAddress on the user to 10.1.2.3
However, we can't see the Framed-IP-Address value being updated in the log.
We'd like to set Framed-Ip-Address on the reply:
post-auth {
if (network-auth-LDAP-Group == "xxxcompany-vpn") {
update reply {
Framed-Ip-Address := 10.1.2.3
}
} else {
reject
}
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
That works however ^ Is there a way to refer to LDAP attributes in the post-auth section? Something like this?
post-auth {
if (network-auth-LDAP-Group == "xxxcompany-vpn") {
update reply {
Framed-Ip-Address := %{ldap:'radiusFramedIpAddress'}
}
} else {
reject
}
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}