On Jul 7, 2015, at 4:54 PM, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
emm ... as I figured out, the problem is in password format though ... it has to be the same as User-Name attribute value passed by NAS to FR ...
The password isn't the User-Name.
in my case it was MAC address in lowercase without delimiters (it is how commutators, at least Cisco SF300 format User-Name) while in LDAP DB I'm trying to switch to the format of FR normalized MAC (uppercase dash delimited) ... is this problem due to pap issue you described?
No.
after I changed password to the value of User-Name attribute passed from NAS, the Access-Accept succeeded ...
so, now I wonder, can I somehow rewrite User-Name value to use normalized MAC?
Don't do that.
I think it is good idea to use FR normalized MAC format in LDAP DB for login/password, and for that I'd like to put Calling-Station-Id value to User-Name and further, to use normalized format
Not everyone uses LDAP.
is it sound good? or may be this practice is already common and I am reinventing the wheel?
In v3, see raddb/policy.d/canonicalization It has policies to normalize MAC addresses in Calling-Station-Id. The same policies can be applied to other attributes, too. Alan DeKok.