<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='color:#1F497D'>Ok, from what I see that won’t
work..<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>If I rewrite a username in preproxy<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Ie(<a href="mailto:billy@foo.net">billy@foo.net</a>)
to <a href="mailto:billy@beg.net">billy@beg.net</a> then in proxy username is authed
cause radius only looks at username with stripped realm<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I need to watch for billy to
login and if he uses any other realm besides <a href="mailto:billy@beg.net">billy@beg.net</a>
then reject him before he even gets to the<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Being authed by server, cause my
server strips realm off and only sees the username<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Rewriting the realm on the auth
request for this user would allow him login no matter what<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I think best approach would be
to watch for any username named billy and if his realm does not match realm he
is allowed from then<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Reject access before he is sent for
authentation and the realm has been stripped as it is suppose to be<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Maybe I am wrong here do not
know, but here is why I am trying to do this.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Jeff<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'><o:p> </o:p></span></a></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org
[mailto:freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org] <b>On
Behalf Of </b>Jeff A<br>
<b>Sent:</b> Saturday, February 13, 2010 1:54 PM<br>
<b>To:</b> 'FreeRadius users mailing list'<br>
<b>Subject:</b> RE: Allowing user from one realm but not another<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>So far no luck, but I will keep
looking.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org
[mailto:freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org] <b>On
Behalf Of </b>Gary Gatten<br>
<b>Sent:</b> Saturday, February 13, 2010 11:32 AM<br>
<b>To:</b> freeradius-users@lists.freeradius.org<br>
<b>Subject:</b> Re: Allowing user from one realm but not another<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'>LOL, easy to do with FR. I was just getting the hang of it when I
was pulled off to another project.<br>
<br>
Check out the operators and unlang. Maybe there are some examples within the
users file with similar replacement operations.</span><span style='font-size:
12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'>
<hr size=2 width="100%" align=center>
</span></div>
<p class=MsoNormal style='margin-bottom:12.0pt'><b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'>From</span></b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'>:
freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org
<freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org> <br>
<b>To</b>: 'FreeRadius users mailing list'
<freeradius-users@lists.freeradius.org> <br>
<b>Sent</b>: Sat Feb 13 10:17:42 2010<br>
<b>Subject</b>: RE: Allowing user from one realm but not another </span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='color:#1F497D'>Yes that would work not not sure
how to implement this. I have been trying to find a written example of
someone who has done this<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>On the search engines but all I
have accomplished is making myself confused<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org
[mailto:freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org] <b>On
Behalf Of </b>Gary Gatten<br>
<b>Sent:</b> Saturday, February 13, 2010 11:11 AM<br>
<b>To:</b> freeradius-users@lists.freeradius.org<br>
<b>Subject:</b> Re: Allowing user from one realm but not another<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'>Assuming there are not duplicate names, can't you jus rewrite his
auth request so its always the realm you want? Billy.* = Billy.beg</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'>
<hr size=2 width="100%" align=center>
</span></div>
<p class=MsoNormal style='margin-bottom:12.0pt'><b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'>From</span></b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'>: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org
<freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org> <br>
<b>To</b>: freeradius-users@lists.freeradius.org
<freeradius-users@lists.freeradius.org> <br>
<b>Sent</b>: Sat Feb 13 09:52:33 2010<br>
<b>Subject</b>: Allowing user from one realm but not another </span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<p class=MsoNormal>Heres my issue and no idea exactly how to do this.<o:p></o:p></p>
<p class=MsoNormal>Trying to figure it out is making me more confused.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>1<sup>st</sup> I use the usersfile for authentation <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have three different realms users can login with<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>For examples they are (foo.net, bar.net, beg.net)<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>When users login from one of the realms from my two upstream
providers they login as one of these realms<o:p></o:p></p>
<p class=MsoNormal>Then freeradius will strip the realm and auth the user<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>My delima is I have some users that abused a certain realm
usage and I want to restrict them to another realm for login and deny the
others<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Say <a href="mailto:billy@foo.net">billy@foo.net</a> has
abused the foo.net realm now I need him solely on the beg.net and disallowing
the other two realms. In other words reject him before if he trys to use the
old realm again. In other words I want to allow only billy to use this one new
realm and be rejected if he trys another realm.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>This has to take place I figure in preproxy, cause my users
file is authenticated minus the realm in proxy..<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>But as I said I have no idea on what to do to set this up..<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I would not mind adding usernames to a file to be prechecked
at preproxy and if user is and he is not using realm specified reject him ,
just not sure what to do or how..<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Jeff<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Times New Roman","serif"'>"This
email is intended to be reviewed by only the intended recipient and may contain
information that is privileged and/or confidential. If you are not the intended
recipient, you are hereby notified that any review, use, dissemination,
disclosure or copying of this email and its attachments, if any, is strictly
prohibited. If you have received this email in error, please immediately notify
the sender by return email and delete this email from your system." </span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Times New Roman","serif"'>"This
email is intended to be reviewed by only the intended recipient and may contain
information that is privileged and/or confidential. If you are not the intended
recipient, you are hereby notified that any review, use, dissemination, disclosure
or copying of this email and its attachments, if any, is strictly prohibited.
If you have received this email in error, please immediately notify the sender
by return email and delete this email from your system." </span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
</body>
</html>