Hi Kalik,<br><br>Thanks for your help...<br>Now i can send two Qos profiles and it's working fine.<br><br>Thanks,<br>Gayathri<br><br><div class="gmail_quote">On Wed, Jul 8, 2009 at 3:30 PM, <span dir="ltr"><<a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Send Freeradius-Users mailing list submissions to<br>
<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.freeradius.org/mailman/listinfo/freeradius-users" target="_blank">http://lists.freeradius.org/mailman/listinfo/freeradius-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:freeradius-users-owner@lists.freeradius.org">freeradius-users-owner@lists.freeradius.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Freeradius-Users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: freeradius active directory integration fails with "no<br>
such realm" (Andrei-Florian Staicu)<br>
2. Re: want to authorise but not authenticate (Arran Cudbard-Bell)<br>
3. Re: want to authorise but not authenticate (Ivan Kalik)<br>
4. Re: How to configure 2 wimax qos profiles for the user in<br>
users file (Ivan Kalik)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 08 Jul 2009 12:31:21 +0300<br>
From: Andrei-Florian Staicu <<a href="mailto:andrei.staicu@gmail.com">andrei.staicu@gmail.com</a>><br>
Subject: Re: freeradius active directory integration fails with "no<br>
such realm"<br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Message-ID: <<a href="mailto:4A546769.8020709@googlemail.com">4A546769.8020709@googlemail.com</a>><br>
Content-Type: text/plain; charset=ISO-8859-2; format=flowed<br>
<br>
Alan DeKok wrote:<br>
> Andrei-Florian Staicu wrote:<br>
><br>
>> Hello again. I've reached the output from here:<br>
>> <a href="http://pastebin.com/d19f28a24" target="_blank">http://pastebin.com/d19f28a24</a> , and i still don't understand why it<br>
>> doesen't call the ntlm_auth line<br>
>><br>
><br>
> It looks like you are adding a "Proxy-To-Realm := LOCAL".<br>
><br>
> ...<br>
><br>
>> PEAP: Sending tunneled request<br>
>> EAP-Message =<br>
>> 0x02060018014950534f305c616e647265692e737461696375<br>
>> FreeRADIUS-Proxied-To = 127.0.0.1<br>
>> User-Name = "IPSO0\\andrei.staicu"<br>
>> server inner-tunnel {<br>
>> +- entering group authorize<br>
>> rlm_realm: Looking up realm "IPSO0" for User-Name =<br>
>> "IPSO0\andrei.staicu"<br>
>> rlm_realm: Found realm "IPSO0"<br>
>> rlm_realm: Adding Stripped-User-Name = "andrei.staicu"<br>
>> rlm_realm: Adding Realm = "IPSO0"<br>
>> rlm_realm: Authentication realm is LOCAL.<br>
>> ++[ntdomain] returns noop<br>
>> ++[mschap] returns noop<br>
>> ++[control] returns noop<br>
>><br>
><br>
> Why is that "update control" section there? What is in it?<br>
><br>
><br>
><br>
>> rlm_eap: Request is supposed to be proxied to Realm LOCAL. Not doing<br>
>><br>
> EAP.<br>
><br>
> It's being proxied to realm LOCAL. You have added a LOCAL realm.<br>
> Don't do that.<br>
><br>
><br>
>> ++[eap] returns noop<br>
>> WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not<br>
>> exist! Cancelling invalid proxy request.<br>
>><br>
><br>
> Even more proof. The IPSO0 realm above is added because it exists.<br>
> The server does NOT add a "Proxy-To-Realm := LOCAL". You have done<br>
> that. Delete it from your configuration.<br>
><br>
> Alan DeKok.<br>
> -<br>
> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
><br>
><br>
It works now. Thank you very much for clearing thing up for me.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 08 Jul 2009 10:33:22 +0100<br>
From: Arran Cudbard-Bell <<a href="mailto:A.Cudbard-Bell@sussex.ac.uk">A.Cudbard-Bell@sussex.ac.uk</a>><br>
Subject: Re: want to authorise but not authenticate<br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Message-ID: <<a href="mailto:4A5467E2.5040309@sussex.ac.uk">4A5467E2.5040309@sussex.ac.uk</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
On 8/7/09 10:19, <a href="mailto:A.L.M.Buxey@lboro.ac.uk">A.L.M.Buxey@lboro.ac.uk</a> wrote:<br>
> hi,<br>
><br>
> heres one for a wednesday morning.<br>
><br>
><br>
> we have a system that we've been done plain authorizations<br>
> via FreeRADIUS - the device sends the following RADIUS request<br>
><br>
> username: userid<br>
> password: userid<br>
><br>
> (ie the system sends the username and makes the password the same)<br>
><br>
> okay. fair enough....a bit of unlang and a check that if the username = password<br>
> then set the Auth-Type to something false et voila. all okay.<br>
><br>
><br>
> it has now been decided to also do authentication via RADIUS<br>
> and this is where things get messy.<br>
><br>
><br>
> by removing the Auth-Type kludge, we can successfully authenticate<br>
> a real user with their real password.... however, the authorization<br>
> now fails because the device still sends username/password with<br>
> the password the same as the username - this now hits the<br>
> FreeRADIUS server which cannot find a valid Auth-Type for the user<br>
> and thus fails authentication and therefore sends back a 'blurgh'<br>
> to the box requesting authorization.<br>
<br>
authorize {<br>
if((User-Name == User-Password) && %{ldap:etc...}){<br>
update control {<br>
Auth-Type := 'NULL'<br>
}<br>
}<br>
else {<br>
// Authentication modules<br>
}<br>
}<br>
<br>
<br>
Auth-Type NULL {<br>
ok<br>
}<br>
<br>
><br>
> this is to be expected because there is nothing in the request to<br>
> distoniguish between an authorization request and an authentication<br>
> request.<br>
><br>
> so the question is, how do we handle this so that the system can<br>
> send a username=password for authorization AND a proper authentication<br>
> can happen WITHOUT (hers a gotcha) the user doing something cute<br>
> like putting their username in as their password! ;-)<br>
<br>
Slightly confused as to what you want... Try again without the caffeine ?<br>
<br>
Arran<br>
<br>
--<br>
Arran Cudbard-Bell <<a href="mailto:A.Cudbard-Bell@sussex.ac.uk">A.Cudbard-Bell@sussex.ac.uk</a>>,<br>
Systems Administrator (AAA),<br>
Infrastructure Services (IT Services),<br>
E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT<br>
DDI+FAX: +44 1273 873900 | INT: 3900<br>
GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Wed, 8 Jul 2009 10:35:04 +0100 (BST)<br>
From: "Ivan Kalik" <<a href="mailto:tnt@kalik.net">tnt@kalik.net</a>><br>
Subject: Re: want to authorise but not authenticate<br>
To: "FreeRadius users mailing list"<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Message-ID:<br>
<<a href="mailto:10825.194.176.105.43.1247045704.squirrel@webmail.kalik.net">10825.194.176.105.43.1247045704.squirrel@webmail.kalik.net</a>><br>
Content-Type: text/plain;charset=utf-8<br>
<br>
> we have a system that we've been done plain authorizations<br>
> via FreeRADIUS - the device sends the following RADIUS request<br>
><br>
> username: userid<br>
> password: userid<br>
><br>
> (ie the system sends the username and makes the password the same)<br>
><br>
> okay. fair enough....a bit of unlang and a check that if the username =<br>
> password<br>
> then set the Auth-Type to something false et voila. all okay.<br>
><br>
><br>
> it has now been decided to also do authentication via RADIUS<br>
> and this is where things get messy.<br>
><br>
><br>
> by removing the Auth-Type kludge, we can successfully authenticate<br>
> a real user with their real password.... however, the authorization<br>
> now fails because the device still sends username/password with<br>
> the password the same as the username - this now hits the<br>
> FreeRADIUS server which cannot find a valid Auth-Type for the user<br>
> and thus fails authentication and therefore sends back a 'blurgh'<br>
> to the box requesting authorization.<br>
><br>
> this is to be expected because there is nothing in the request to<br>
> distoniguish between an authorization request and an authentication<br>
> request.<br>
><br>
> so the question is, how do we handle this so that the system can<br>
> send a username=password for authorization AND a proper authentication<br>
> can happen WITHOUT (hers a gotcha) the user doing something cute<br>
> like putting their username in as their password! ;-)<br>
<br>
Send Service-Type = Authorize-Only in authorization request. Then you can<br>
distinguish between the requsts. Or do authorization in the same time as<br>
authentication.<br>
<br>
Without opening a major security hole. You can set Auth-Type to Accept if<br>
User-Name = User-Password in the request but that would enable anyone to<br>
log in knowing just username.<br>
<br>
Ivan Kalik<br>
Kalik Informatika ISP<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Wed, 8 Jul 2009 10:39:48 +0100 (BST)<br>
From: "Ivan Kalik" <<a href="mailto:tnt@kalik.net">tnt@kalik.net</a>><br>
Subject: Re: How to configure 2 wimax qos profiles for the user in<br>
users file<br>
To: "FreeRadius users mailing list"<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Message-ID:<br>
<<a href="mailto:59554.194.176.105.43.1247045988.squirrel@webmail.kalik.net">59554.194.176.105.43.1247045988.squirrel@webmail.kalik.net</a>><br>
Content-Type: text/plain;charset=utf-8<br>
<br>
> I am trying to configure the two wimax qos profiles for the single user as<br>
> one for uplink and another for downlink.<br>
> If i configure the same attributes two times, in the Access-Accept message<br>
> the first configured wimax attribute value only is sending but its not<br>
> sending the same attribute again which has different value. is there any<br>
> way<br>
> to do this and make it work?<br>
<br>
<a href="http://wiki.freeradius.org/Operators" target="_blank">http://wiki.freeradius.org/Operators</a><br>
<br>
+=<br>
<br>
Ivan Kalik<br>
Kalik Informatika ISP<br>
<br>
<br>
<br>
------------------------------<br>
<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
<br>
End of Freeradius-Users Digest, Vol 51, Issue 30<br>
************************************************<br>
</blockquote></div><br>