Rob Ansaldo wrote:
We are already running a MS IAS Radius server that uses our AD, but what we would like to do is to use FreeRADIUS to proxy requests to our IAS server and add in some vendor specific attributes that we would set in a MySQL database.
That should be possible.
The IAS server does not have these attributes, nor do we want to use the IAS server for them.
Or... you could just use FreeRADIUS for everything. :)
What would be preferred is to set the attributes in the MySQL database based on other business logic. These are 802.1x wireless clients connecting to our wireless controller. I have successfully configured FreeRADIUS to proxy the requests from the wireless controller to our IAS server. Where I am having trouble is applying any sort of custom attributes to the response. I can see that the client username is being queried, a group is being obtained and the attributes for that group are being queried but they never appear in the Access-Accept.
You're doing the SQL lookup before the proxy. So the response from IAS is overwriting it.
The configuration uses the default configuration files, except that I have added my wireless controller to clients.conf, a DEFAULT proxy to the IAS server, uncommented the sql section in radius.conf and added the settings for my MySQL server.
That should *mostly* work. See below.
Is what I am trying to do possible and if so, how would I go about it?
Yes. Delete "sql" from the "authorize" section. Instead, add it to the "post-auth" section as "sql.authorize". The SQL module will be queried *after* it receives the Access-Accept from IAS. The SQL queries which are used will be the ones you've already configured from "authorize", which seem to work. Alan DeKok.