February 2023 - Freeradius-Users - lists.freeradius.org

Skip authorize if proxy? Preprocess deprecated?
by contact＠brindereseau.fr 03 Feb '23

03 Feb '23

Hello, Thanks for FreeRADIUS and the incredible amount of work. The more I use it, the more I love it, especially Unlang which allows for flexible and specific pre and post processing. I just wonder about the RADIUS sequence (v3 but v4 may be also concerned): why neither the default sequence or the doc suggests to employ such a below logic? authorize { filter_username suffix if (!&control:Proxy-To-Realm) { # or check "&control.Auth-Type" in v4 sql my_super_module my_other_module # some other things... chap pap } } My point being: once we know that proxy is needed (told by "suffix" usually), it seems to me the rest of "authorize" section can be skipped *in most cases*. It would gain some time and prevent potential side effects by subsequent modules (depending on what they do, of course). Or am I wrong? Did I miss something? Also, yet not related, is "preprocess" actually deprecated in favor of a custom module in Unlang? Or is there a reason to still use it (execution time, backward compatibility)? It seems to have disappeared in v4. Thanks!

2 2

Re: Extracting a value from an LDAP attribute
by florentvercourt＠gmail.com 02 Feb '23

02 Feb '23

>If the returned value always matches the same kind of format, I would suggest using a regex to extract the relevant part, so, after the call to the ldap module something like: > >if (&reply:Tunnel-Private-Group-ID =~ /vlan:([0-9]+)/) { ??? update reply { ??? ??? &Tunnel-Private-Group-ID := "%{1}" > ??? } >} > >That's looking for any digits after vlan: in the returned value - you will have to understand the possible formats of the returned data to know whether that will work. > Thank you, I try your solution and it works

1 0

Extracting a value from an LDAP attribute
by florentvercourt＠gmail.com 02 Feb '23

02 Feb '23

Hello all, I have been looking for a way to extract a part of an LDAP attribute that I retrieved and map to the RADIUS attribute " Tunnel-Private-Group-Id". The syntax of my LDAP attribute: "schacUserStatus : urn:mace:terena.org:schac:userStatus:FR:vlan:13+mode=manuel" I want to extract the number of the vlan, to affect it to " Tunnel-Private-Group-Id" attribute. With the given example, I want to only have "13" stored in " Tunnel-Private-Group-Id". I tried that in the ldap module : update { control:Password-With-Header += 'userPassword' reply:Tunnel-Private-Group-ID := 'schacUserStatus' } However, with this solution I retrieve "urn:mace:terena.org:schac:userStatus:FR:vlan:13+mode=manuel" in " Tunnel-Private-Group-Id". I also try to split it, but its length is 1. I read all the documentations at https://networkradius.com/doc/3.0.10 and I still don't know if there is a way to do that in unlang, and if so, do I have to do it in the ldap module, or in my virtual server configuration; or if it's possible to parse the LDAP attribute using Bash commands. Thank you for your advice and help, Florent VERCOURT

2 1