Re: URL authentication

[Thibault Le Meur <Thibault.LeMeur@supelec.fr>]

> > This puts it into the access-request and the radius server sees it
> > rad_recv: Access-Request packet from host 127.0.0.1:32770, id=106,  
> > length=79
> >         User-Name = "joe"
> >         User-Password = "testing"
> >         incoming-req-uri = "http://www.blibble.net/path_to";
> >   Processing the authorize section of radiusd.conf
> >
> >
> > > Now, I can extend the radcheck table to include the URL and add  
> > > that into the sql query as defined in mysql.conf, but how do I get  
> > > freeradius to authenticate on the triple?

This is simple to implement in the users file (files module) and should 
be easy as well in the mysql backend (though I don't have experience on 
this one).

You'll have to define specific rules that check both authentication and 
your attribute for your Cisco 'web device'. I propose to define a 
Huntgroup for your cisco web devices and then you can add rules like 
these ones:

DEFAULT Huntgroup-Name == My-Cisco, incoming-req-uri != 
"http://www.blibble.net/path_to";, Auth-Type := Reject
   Fall-Through  = no

DEFAULT Huntgroup-Name == My-Cisco, incoming-req-uri == 
"http://www.blibble.net/path_to";
   Fall-Through  = no

In order to implement these rules directly in mysql see the doc/rlm_sql file.

If this does not work, stop the radius server and then run it in debug mode:
/etc/init.d/radiusd stop
radiusd -X
...


Then run your Radius authentication request and send the debug log to 
the list.

HTH,
Thibault