Hi list: I've been working hard to let freeradius handles "Service-Type = AUTHENTICATE_ONLY" the proper way, but i couldn't achieve that till I've changed two lines in the source code with you this patch freeradius understands AUTHENTICATE_ONLY and doesn't complain about it, but handles it as all other service types (i.e. runs the post-auth module and sets network configuration in the reply) while it must only authenticate the user and returns a network configuration free accept/reject reply the patch below could be applied to freeradius-1.1.6 Best regards diff -uNrp orig_freeradius-1.1.6/src/main/auth.c freeradius-1.1.6/src/main/auth.c --- orig_freeradius-1.1.6/src/main/auth.c 2007-04-25 10:45:08.000000000 +0300 +++ freeradius-1.1.6/src/main/auth.c 2007-04-25 10:47:12.000000000 +0300 @@ -1025,8 +1025,9 @@ autz_redo: if (exec_program) free(exec_program); - - result = rad_postauth(request); + check_item = pairfind(request->packet->vps, PW_SERVICE_TYPE); + if (check_item && check_item->lvalue != PW_AUTHENTICATE_ONLY) + result = rad_postauth(request); return result; } -- Muhammad Tayseer Alquoatli
On Wednesday 25 April 2007 04:35:13 Muhammad Tayseer Alquoatli wrote:
Hi list: I've been working hard to let freeradius handles "Service-Type = AUTHENTICATE_ONLY" the proper way, but i couldn't achieve that till I've changed two lines in the source code with you this patch freeradius understands AUTHENTICATE_ONLY and doesn't complain about it, but handles it as all other service types (i.e. runs the post-auth module and sets network configuration in the reply) while it must only authenticate the user and returns a network configuration free accept/reject reply the patch below could be applied to freeradius-1.1.6 Best regards
I'm receiving Authenticate-Only requests and FreeRADIUS doesn't complain. What errors are you seeing? Would attr_filter be able to strip all unwanted attributes for you, instead of making code modifications? Kevin Bonner
On April 25, 2007 3:05:54 PM -0400 Kevin Bonner <keb@pa.net> wrote:
On Wednesday 25 April 2007 04:35:13 Muhammad Tayseer Alquoatli wrote:
Hi list: I've been working hard to let freeradius handles "Service-Type = AUTHENTICATE_ONLY" the proper way, but i couldn't achieve that till I've changed two lines in the source code with you this patch freeradius understands AUTHENTICATE_ONLY and doesn't complain about it, but handles it as all other service types (i.e. runs the post-auth module and sets network configuration in the reply) while it must only authenticate the user and returns a network configuration free accept/reject reply the patch below could be applied to freeradius-1.1.6 Best regards
I'm receiving Authenticate-Only requests and FreeRADIUS doesn't complain. What errors are you seeing? Would attr_filter be able to strip all unwanted attributes for you, instead of making code modifications?
I'll second that. I can't imagine any case where configuration alone, using the existing code, can't make it work. -frank
On 4/25/07, Frank Cusack <fcusack@fcusack.com> wrote:
On April 25, 2007 3:05:54 PM -0400 Kevin Bonner <keb@pa.net> wrote:
On Wednesday 25 April 2007 04:35:13 Muhammad Tayseer Alquoatli wrote:
Hi list: I've been working hard to let freeradius handles "Service-Type = AUTHENTICATE_ONLY" the proper way, but i couldn't achieve that till I've changed two lines in the source code with you this patch freeradius understands AUTHENTICATE_ONLY and doesn't complain about it, but handles it as all other service types (i.e. runs the post-auth module and sets network configuration in the reply) while it must only authenticate the user and returns a network configuration free accept/reject reply the patch below could be applied to freeradius-1.1.6 Best regards
I'm receiving Authenticate-Only requests and FreeRADIUS doesn't complain. What errors are you seeing? Would attr_filter be able to strip all unwanted attributes for you, instead of making code modifications?
I'll second that. I can't imagine any case where configuration alone, using the existing code, can't make it work.
Thank you, I maybe miss some configuration, but I'm not saying that freeradius is complaining about receiving and Authenticate-Only service type, but i'm saying its handling it the same way as a framed-user service type. I'm expecting FreeRadius to just authenticate me and not give me an IP address if "Authenticate-Only" service type is desired, but freeradius is always reserving an IP address for me even if Service-Type=Authenticate-Only and this what i couldn't change without code modification I hope I've made it clear, and i appreciate sending me the appropriate configuration if anyone could send FreeRadius an access-request where Service-Type=Authenticate-Only is set and receive just an access-reject or access-accept without any network configuration returned in the reply Thanks a lot -- Muhammad Tayseer Alquoatli
Muhammad Tayseer Alquoatli wrote:
Thank you, I maybe miss some configuration, but I'm not saying that freeradius is complaining about receiving and Authenticate-Only service type, but i'm saying its handling it the same way as a framed-user service type.
The server handles this request the same way as for any other request: It does what you tell it to do.
I'm expecting FreeRadius to just authenticate me and not give me an IP address if "Authenticate-Only" service type is desired, but freeradius is always reserving an IP address for me even if Service-Type=Authenticate-Only and this what i couldn't change without code modification
As RADIUS administrator, it is your choice whether or not to follow the request from the client. If you do follow it, you can configure the server to do authentication, and nothing else. If you choose to handle the request differently, that is your power as administrator.
I hope I've made it clear, and i appreciate sending me the appropriate configuration if anyone could send FreeRadius an access-request where Service-Type=Authenticate-Only is set and receive just an access-reject or access-accept without any network configuration returned in the reply
You can configure the server to do that. It does not require source code modifications. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (4)
-
Alan DeKok -
Frank Cusack -
Kevin Bonner -
Muhammad Tayseer Alquoatli