<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
James Wakefield wrote:
<blockquote cite="mid45204F9D.7000805@deakin.edu.au" type="cite">isidoros
wrote:
<br>
<blockquote type="cite"><br>
Goal:
<br>
users X,Y,Z should only be authenticated on NAS1 and not on NAS2 or any
other nas
<br>
users A,B,C should only be authenticated on NAS2 and not on NAS1 or any
other nas
<br>
etc
<br>
</blockquote>
<br>
<br>
G'day,
<br>
<br>
You'll probably want users X,Y,Z mapped to one group (let's say, G1),
and A,B,C mapped to another (let's say, G2) in your usergroup table.
You can then use NAS-IP-Address as a check item in radgroupcheck to
authorize only G1 from NAS1's IP address, and authorize only G2 from
NAS2's IP address. You shouldn't have to touch any of the SQL queries
in sql.conf.
<br>
<br>
<a class="moz-txt-link-freetext" href="http://wiki.freeradius.org/Rlm_sql">http://wiki.freeradius.org/Rlm_sql</a> should provide the info you need to
do the above.
<br>
<br>
Cheers,
<br>
</blockquote>
Thanks James for your answer,<br>
<br>
I'm fairly new to freeradius I know the package only 14 days. (or
radius in general for that matter)<br>
<br>
The group configuration is a mystery to me. It is unclear for me how
this separates the users. This is how I think<br>
1) G1 with users A,B,C<br>
2) G2 with users X,Y,Z<br>
3) At a request the configuration determines which group the user
belongs to<br>
4) And makes a query for the users A until Z to the same database<br>
5) the auth_query only talks about the user.<br>
6) This is the point where a fail to understand that the group config
helps me. The query is made to the same database on behalf of the any
user.<br>
<br>
Please spell it out to me where my thinking goes wrong. I would like
the understand this group config thing better (if at all at this point
in time).<br>
<br>
In the meanwhile:<br>
I have solved the problem with the below changes:<br>
<br>
in
sql.conf replace this rule with:<o:p></o:p><br>
authorize_check_query
= "SELECT id, UserName, Attribute, Value, op \<o:p></o:p><br>
FROM
${authcheck_table} \<o:p></o:p><br>
WHERE
Username = '%{SQL-User-Name}' AND \<o:p></o:p><br>
Location
= (SELECT Location FROM nas WHERE nasname = '%{NAS-Identifier}') \<o:p></o:p><br>
ORDER BY
id"<br>
<p class="MsoNormal" style=""><span
style="font-size: 10pt; font-family: Arial;"><o:p></o:p><br>
in mysql<o:p></o:p></span></p>
<p class="MsoNormal" style=""><span
style="font-size: 10pt; font-family: Arial;">fill the
nas table with your info:<o:p></o:p><br>
INSERT
INTO nas (nasname, nasshortname, type, secret, Location) VALUES
('yournasname
in chillspot', 'anyname' , 'other', 'shared secret', 'Location-number '.<span
style=""> </span>);<o:p></o:p></span></p>
It works, but I have no idea if this is "best practice" or I'm
seriously damaging the config.<br>
<br>
regards,<br>
<br>
isidoros<br>
</body>
</html>