On Tue, 20 Mar 2007 09:38:25 -0500 Alan DeKok <aland@deployingradius.com> wrote:
Sam Schultz wrote:
I have set a DEFAULT entry that sets the User-Name attribute via ':=', but I still end up with two User-Name attributes
(anonymous
identity & real identity). This is especially strange, since use_tunneled_reply & copy_request_to_tunnel are both enabled as well.
Then it may be a bug. My tests look like they work, so I'm not sure what the difference is with your configuration.
It worked for me right out of the box at one time, too. I have a feeling it was using either freeradius 1.1.3 or 1.0.3 (or whatever FC2 came pre-packaged with). I'll probably test my configuration against an earlier version later & see if I can establish it as a "bug". The version I've been trying to coerce into working is 1.1.4, which was compiled from source.
If I understand correctly, := should replace the anonymous (first) User-Name value with the real (second) value permitting they are in the same session. Upon looking back at the debug output, it looks like the tunneled request is actually handled as if it were a seperate request than the one containing it (request->eap module-(unpack)-
new request).
Yes.
This would explain why two User-Name attributes are showing up in the final response.
Not entirely. If you have use_tunneled_reply = yes, AND you're doing:
DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name := `%{User-Name}`
Then that name should be copied to the outer tunnel, AND the outer tunnel SHOULD NOT add the "anonymous" username in the reply, because it sees the User-Name copied from the tunnel. See src/modules/rlm_eap/*.c
I may do this as a last resort. In my experience, code dependent on openssl tends to be ugly & hard to follow/understand.
P.S. A link to a list of known-good access points, or personal recommendations on access points would also be appreciated.
See the Wiki. If you have good experiences, add them to the Wiki.
We will be replacing a few 3com APs soon because they don't play well with...well...ANYTHING. One (3com OfficeConnect) doesn't even have options for radius account, even though it advertises the feature right on the box.
Return them as broken.
I planned on it as soon as I get replacements. It doesn't look like 3com even has a bug reporting system of any kind. Well, at least not for customers who don't have a support contract with them, anyway.
Cisco AP350's seems to be pretty solid.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Click for free info on adult education and start making $150k/ year http://tagline.hushmail.com/fc/CAaCXv1S62SI4Y7VFkw7r5uPb1smYR4R/