Identifying Virtual-Server from Inner-Tunnel

[Jordan Dohms]

I’m still fairly new at FreeRADIUS.  Running 2.1.10 (we are planning
our upgrade shortly).

Kind of a two pronged question here...I'm encountering a particular
issue, but also would like to hear if my broad approach is suitable.

I am attempting to do the following:
- Use one FreeRADIUS server to authenticate for two different 802.1X
networks (EAP-PEAP / MSCHAP).
- Both will use the mschap module to interface with Microsoft Active Directory.
- The first 802.1X network will authenticate against DOMAIN1, the
second against both DOMAIN1 and DOMAIN2.  The first network should
reject authentication attempts from DOMAIN2.
- All usernames are specified with a full realm / fqdn.
- The RADIUS clients (wireless access points) will all be the same for
the two networks.

What (I think) is the solution:
- In order for FreeRADIUS to distinguish what set of users (DOMAIN1 or
DOMAIN1/2) to authenticate against, I have setup two virtual servers
listening on different ports and (obviously) different names.
(working)
- The clients connect to FreeRADIUS over a different port depending on
the network they're attempting to connect to. (working)
- Setup realms for both DOMAIN1 and DOMAIN2 to have them both
authenticate locally. (working)
- Setup two mschap modules to call ntlm_auth command with the proper
DOMAIN string. (working)
- Depending on the realm provided, call a different mschap module from
the inner-tunnel. (working)
- Depending on the virtual server the request was received through,
call a different mschap module from the inner-tunnel or reject the
request. (not working)

If there's a better/cleaner/simpler way to do this, I'm all ears.

My issue:
Since its EAP-PEAP, the request passes through the outer and
inner-tunnel virtual servers.  In my inner-tunnel, I'm doing an IF on
the Realm.  That seems to be evaluating properly if I look at the
debug logs.  If I do an IF on Virtual-Server it comes back with
'inner-tunnel'.  If I do outer.request:Virtual-Server it oddly also
comes back with 'inner-tunnel'.  How do I see the actual
virtual-server?  Should I need to set a separate variable in the
outer-server and read it below?

Here is my attempted code in "server inner-tunnel"

        authenticate {
                Auth-Type MS-CHAP {
                        if ("%{outer.request:Virtual-Server}" == "secure") {
                                mschap_domain1
                        }
                        else {
                                if ("%{Realm}" == "domain1.fqdn.org") {
                                        mschap_domain1
                                }
                                elsif ("%{Realm}" == "domain2.fqdn.org") {
                                        mschap_domain2
                                }
                        }
                }
                eap
        }

In my debug logs:

Thu Oct  4 13:05:18 2012 : Info: [mschapv2] +- entering group MS-CHAP {...}
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] ++? if
("%{outer.request:Virtual-Server}" == "secure")
Thu Oct  4 13:05:18 2012 : Info: [mschapv2]     expand:
%{outer.request:Virtual-Server} -> inner-tunnel
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] ? Evaluating
("%{outer.request:Virtual-Server}" == "secure") -> FALSE
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] ++? if
("%{outer.request:Virtual-Server}" == "secure") -> FALSE
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] ++- entering else else {...}
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" ==
"domain1.fqdn.org")
Thu Oct  4 13:05:18 2012 : Info: [mschapv2]     expand: %{Realm} ->
domain2.fqdn.org
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}"
== "domain1.fqdn.org") -> FALSE
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" ==
"domain1.fqdn.org") -> FALSE
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" ==
"domain2.fqdn.org")
Thu Oct  4 13:05:18 2012 : Info: [mschapv2]     expand: %{Realm} ->
domain2.fqdn.org
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}"
== "domain2.fqdn.org") -> TRUE
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" ==
"domain2.fqdn.org") -> TRUE
Thu Oct  4 13:05:18 2012 : Info: [mschapv2] +++- entering elsif
("%{Realm}" == "domain2.fqdn.org") {...}

Any suggestions for what I'm doing wrong or maybe a better way to tackle it?

Thanks,
Jordan Dohms