Sylvain Robitaille wrote:
On the one hand, "OH!!!" I think I'm starting to understand, but on the other hand, I appear to still not be doing it quite right. I put into the "authorize" section of sites-available/default: ... However, then the request carries on to the inner-tunnel of the TTLS transaction (whether or not the outer authorization succeeded or returned not found; is it possible to equate "notfound" to "fail" or "reject"?).
Yes. if (notfound) { fail }
If I configure sites-available/inner-tunnel's authorization section as above, when it gets to that point, debug output says:
++? if (NAS-Port-Type == Wireless-802.11) (Attribute NAS-Port-Type was not found)
Set copy_request_to_tunnel in eap.conf. Or, do: if (outer.NAS-Port-Type == Wireless-802.11) { ... Again, "man unlang" explains "outer.*".
In other words, despite having found the user in the ldap_wireless search in sites-available/default, the inner-tunnel seems to not receive sufficient information about the request to decide to use the ldap_wireless module, leaving the RADIUS server with no way to authenticate the user. This is despite ldap_wireless in sites-available/default having produced:
If you're using TTLS, you *don't* want to do username/password lookups in ldap for sites-enabled/default. That's what the "inner-tunnel" server is for. Do the LDAP calls there.
And also despite the debug output of the request arriving at inner-tunnel *appearing* to contain items sufficient for me to select on:
No... that looks like the *outer* tunnel data. Inner tunnel requests do *not* have a Message-Authenticator attribute.
If I put in inner-tunnel: ... Then
Stop. You are trying too many options, and too many different configurations. It's not worth it. Keep the outer and inner tunnel configurations separate. That's why they are in different virtual servers... because they are separate. In the inner tunnel server, use "outer.Attribute-Name" to access attributes *outside* of the tunnel. Honestly, it's not that difficult. Find *something* in the outer request that is there only for wireless requests. Key off of that in the *inner* tunnel to select the users from the correct LDAP instance. if (outer.NAS-Port-Type == foo) { ldap_foo } elsif (outer.NAS-Port-Type == bar) { ldap_bar } Alan DeKok.