<div class="gmail_quote">On Mon, Aug 9, 2010 at 6:31 PM, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">Peter Lambrechtsen wrote:<br>
> Using FreeRadius 2.1.7 and trying to get the postauth_users to return an<br>
> access reject however it always seems to return either a noop or ok.<br>
</div>..<br>
<div class="im">> And this is what is in my postauth_users file:<br>
><br>
> DEFAULT Auth-Type := REJECT<br>
> Post-Auth-Type = Reject,<br>
<br>
</div> Hmm... you are trying to change the *authentication* type to reject<br>
after the *authenticate* section has been executed. This won't work.<br></blockquote><div><br>Right, so this is my business use case and I think I have figured out the best way, but would love your input.<br><br>1) We have a centralised LDAP directory which holds all employees. We have an IDM solution which provisions employees into the LDAP directory based on their role as driven out of the HR system. This is a very robust and automated system which the team I look after maintains.<br>
<br>2) There a lot of Network Elements (NAS's) such as Routers, and Telco DSLAMs and a raft of other devices used for both customer and employees to login. These need to be grouped into nas group types, so that we can AA customers and employees to permit them to login to those groups of devices. I am using Huntgroup's to group the NAS's together. This is driven out of LDAP. In my authorize section I have the following:<br>
<br>authorize {<br>update request {<br> Huntgroup-Name := "%{ldap:ldap:///ou=Elements,ou=Applications,o=Identities?l?sub?cn=%{Packet-Src-IP-Address}}"<br>}<br> ldap<br>}<br><br>This way I create Group objects as the IP address of the source NAS in the LDAP directory with a "location" or "L" attribute set to the Huntgroup-Name I want set. This works very effectivly to set the Huntgroup name.<br>
I also have "ldap" so that the incoming account is also looked up to see if it exists.<br><br>3) We want to drive access to the elements using a user being a member of a certain LDAP group.<br><br>4) We want to make sure the username and password is correct for the user entered. So in the authenticate we have:<br>
authenticate {<br> Auth-Type LDAP {<br> ldap<br> }<br>}<br><br><br>5) The NAS's have a number of different profiles (admin, r/w, r/o etc) and each NAS group has a different group of VSA's they want back. So in the postauth_users file I have the following:<br>
<br>DEFAULT Huntgroup-Name == NAS1, Ldap-Group == "cn=admin,ou=Profiles,ou=Riverstone,ou=Applications,o=Identities", Auth-Type := Accept<br> Service-Type = "Login-User",<br> Riverstone-User-Level = "15"<br>
<br>DEFAULT Huntgroup-Name == NAS1, Ldap-Group ==
"cn=guest,ou=Profiles,ou=Riverstone,ou=Applications,o=Identities",
Auth-Type := Accept<br> Service-Type = "Login-User",<br> Riverstone-User-Level = "1"<br>
<br>DEFAULT Huntgroup-Name == NAS2, Ldap-Group ==
"cn=admin,ou=Profiles,ou=Cisco,ou=Applications,o=Identities",
Auth-Type := Accept<br>
Service-Type = "Login-User",<br> Cisco-AVPair = "shell:priv-lvl=15"<br><br>And so on..<br><br>The issue I had was if none of the Huntgroups matched to the user being a member of group x, I needed to return a access-reject.<br>
<br>The only way I could achieve this was to add onto the end of the postauth_users file:<br><br>DEFAULT Auth-Type := Reject<br> Reply-Message = "Reject"<br><br>And in my post-auth section have:<br><br>post-auth {<br>
files<br> if ("%{reply:Reply-Message}" == "Reject") {<br> reject<br> }<br>}<br><br><br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im"><br>
> Ideally I would assume if the Auth-Type := Reject then the return should<br>
> be "RLM_MODULE_REJECT".<br>
<br>
</div> No. Setting "Auth-Type := Reject" is useful ONLY in the "authorize"<br>
section, *before* the "authentication" section has been run. It doesn't<br>
reject the user immediately. Instead, it tells the server to run the<br>
"reject" authentication method.<br></blockquote><div><br>So would it be better to have the postauth_users lookup to be in the authorize section and rename my "postauth_users" to just "users", and do it at that point? <br>
<br>The issue with having in the authorize section:<br><br>authorize {<br>update request {<br> Huntgroup-Name := "%{ldap:ldap:///ou=Elements,ou=Applications,o=Identities?l?sub?cn=%{Packet-Src-IP-Address}}"<br>
}<br> ldap<br> files<br>
}<br><br>Is that it never seems to go into the authenticate section.<br><br>Any suggestions on how to best achieve this apart from how I am doing it?<br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">
> Since otherwise I think I will need to lookup if the Reply-Message is<br>
> set to disabled, and then do a reject.<br>
<br>
</div> No.<br>
<br>
If you want the post-auth section to return "reject", just put<br>
"reject" into the list of modules to be run:<br>
<br>
post-auth {<br>
...<br>
reject<br>
...<br>
}<br>
<br>
See "man unlang" for details.<br></blockquote><div><br>I have done that, as per my above suggestion.<br><br>Cheers<br><br>Peter<br></div></div><br>