<html>
<head>
<style>
P
{
margin:0px;
padding:0px
}
body
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body>I think you have to use the attribute "<font size="-1"><b>Stripped-User-Name</b></font>" to authenticate the user.<br><br><br><br><br><hr id="stopSpelling">> Date: Wed, 24 Jan 2007 14:21:59 +0800<br>> From: LFK@cc.hku.hk<br>> To: freeradius-users@lists.freeradius.org<br>> Subject: Proxying based on SSID<br>> <br>> Hi,<br>> <br>> Sorry if the questions have been asked. I have done a lot of searches,<br>> but could not find the answer.<br>> <br>> Normally, I proxy a PEAP request whenever the realm is unknown to us<br>> (i.e. using the DEFAULT realm without stripping user name). However, for<br>> some SSIDs, I want requests to be handled locally with ldap, independent<br>> of what the realm is (and with the user name stripped). What I did is to<br>> find those SSIDs in "Called-Station-ID" and<br>> set proxy-to-realm to a local realm.<br>> <br>> But the problem (I guess) is that when freeradius processes the realm<br>> file, the user name is not stripped. When later on processed by the<br>> local realm, the request fails because the user name still contains the<br>> domain.<br>> <br>> Any suggestions to solve it is appreciated. Thanks in advance.<br>> <br>> Best Regards,<br>> Lai<br>> <br>> Users<br>> =====<br>> DEFAULT NAS-Port-Type == "Wireless-802.11", Called-Station-Id =~<br>> "MY-SSID$", St<br>> rip-User-Name := Yes, Autz-Type := usePlainTextPwd, Proxy-to-realm :=<br>> "hku.hk"<br>> <br>> DEFAULT NAS-Port-Type == "Wireless-802.11", Autz-Type := usePlainTextPwd<br>> <br>> Radiusd -X<br>> =========<br>> rad_recv: Access-Request packet from host 17.18.28.26:20002, id=136,<br>> length=152<br>> NAS-Port-Id = "2098/1"<br>> Calling-Station-Id = "00-18-DE-83-3E-1B"<br>> Called-Station-Id = "00-16-E0-FD-47-40:VIP-peap"<br>> Service-Type = Framed-User<br>> EAP-Message = 0x02010012017063637732406173642e636f6d<br>> User-Name = "pcw2@asd.com"<br>> NAS-Port-Type = Wireless-802.11<br>> NAS-Identifier = "3Com"<br>> NAS-IP-Address = 17.18.28.26<br>> Message-Authenticator = 0x46e6da4a3ad7d253157a9f21a110807b<br>> Processing the authorize section of radiusd.conf<br>> modcall: entering group authorize for request 0<br>> modcall[authorize]: module "preprocess" returns ok for request 0<br>> rlm_realm: Looking up realm "asd.com" for User-Name = "pcw2@asd.com"<br>> rlm_realm: Found realm "DEFAULT"<br>> rlm_realm: Proxying request from user pcw2 to realm DEFAULT<br>> rlm_realm: Adding Realm = "DEFAULT"<br>> rlm_realm: Preparing to proxy authentication request to realm<br>> "DEFAULT"<br>> modcall[authorize]: module "suffix" returns updated for request 0<br>> modcall[authorize]: module "chap" returns noop for request 0<br>> modcall[authorize]: module "mschap" returns noop for request 0<br>> users: Matched entry DEFAULT at line 171<br>> users: Matched entry DEFAULT at line 244<br>> modcall[authorize]: module "files" returns ok for request 0<br>> rlm_eap: EAP packet type response id 1 length 18<br>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>> modcall[authorize]: module "eap" returns updated for request 0<br>> modcall: leaving group authorize (returns updated) for request 0<br>> Found Autz-Type usePlainTextPwd<br>> Processing the authorize section of radiusd.conf<br>> modcall: entering group usePlainTextPwd for request 0<br>> modcall: entering group redundant for request 0<br>> rlm_ldap: - authorize<br>> rlm_ldap: performing user authorization for pcw2@asd.com<br>> radius_xlat: '(&(uid=pcw2@asd.com)))'<br>> radius_xlat: 'ou=ldap,o=hku,c=hk'<br>> rlm_ldap: ldap_get_conn: Checking Id: 0<br>> rlm_ldap: ldap_get_conn: Got Id: 0<br>> rlm_ldap: attempting LDAP reconnection<br>> rlm_ldap: (re)connect to ldap1.hku.hk:389, authentication 0<br>> rlm_ldap: starting TLS<br>> rlm_ldap: bind as cn=net,o=hku,c=hk/M134aNaa to ldap1.hku.hk:389<br>> rlm_ldap: waiting for bind result ...<br>> rlm_ldap: Bind was successful<br>> rlm_ldap: performing search in ou=ldap,o=hku,c=hk, with filter<br>> (&(uid=pcw2@asd.com))<br>> rlm_ldap: object not found or got ambiguous search result<br>> rlm_ldap: search failed<br>> rlm_ldap: ldap_release_conn: Release Id: 0<br>> modcall[authorize]: module "withNTPwd" returns notfound for request 0<br>> modcall: leaving group redundant (returns notfound) for request 0<br>> modcall: leaving group usePlainTextPwd (returns notfound) for request 0<br>> WARNING: You set Proxy-To-Realm = hku.hk, but it is a LOCAL realm!<br>> Cancelling<br>> invalid proxy request.<br>> rad_check_password: Found Auth-Type EAP<br>> auth: type "EAP"<br>> Processing the authenticate section of radiusd.conf<br>> modcall: entering group authenticate for request 0<br>> rlm_eap: EAP Identity<br>> rlm_eap: processing type tls<br>> rlm_eap_tls: Initiate<br>> rlm_eap_tls: Start returned 1<br>> modcall[authenticate]: module "eap" returns handled for request 0<br>> modcall: leaving group authenticate (returns handled) for request 0<br>> WARNING: Cancelling proxy to Realm hku.hk, as the realm is local.<br>> Sending Access-Challenge of id 136 to 17.18.28.26 port 20002<br>> Framed-IP-Address = 255.255.255.254<br>> Framed-MTU = 576<br>> Service-Type = Framed-User<br>> EAP-Message = 0x010200061920<br>> Message-Authenticator = 0x00000000000000000000000000000000<br>> State = 0xfd7f032f1c3ed7e8e39bf1872727e771<br>> Finished request 0<br>> Going to the next request<br>> <br>> <br>> - <br>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<br><br /><hr />Consigue el nuevo Windows Live Messenger <a href='http://get.live.com/messenger/overview' target='_new'>Pruébalo</a></body>
</html>