yes.... with various extra bits of config. firstly, you would need to use unlang to set the authentication to be local for a particular realm, then, in the inner-tunnel, you would need to use unlang to proxy the request to a defined realm pool.
alan
I would like to be able to proxy the Auth request after terminating the EAP-TTLS. FreeRadius sees the realm prefix on the User-Name and wants to proxy first.
Is this possible or even sensible please?
Regards,
Adrian - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On 12 June 2017 at 07:51, <adrian.p.smith@bt.com> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Thanks for the tips, this has got me a lot further. My default server now does the EAP work and passes the Access-Request to the inner-tunnel, but I think I need one last thing as it doesn't want to proxy it: server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [IPASS] Looking up realm "passpoint" for User-Name = "passpoint/adrian" [IPASS] Found realm "passpoint" [IPASS] Adding Realm = "passpoint" [IPASS] Proxying request from user adrian to realm passpoint [IPASS] Preparing to proxy authentication request to realm "passpoint" ++[IPASS] returns updated [suffix] Request already proxied. Ignoring. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop } # server inner-tunnel Do I need to somehow reset the proxy state? Thanks in advance, Adrian -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Peter Lambrechtsen Sent: 12 June 2017 20:58 To: FreeRadius users mailing list Subject: Re: Terminate EAP-TTLS then proxy You would also want to comment the "suffix" module from your main "default" site and add it to inner-tunnel Suffix is what looks up the realms from the proxy.conf and adds the proxy destination to request or not. On 13/06/2017 06:11, "Alan Buxey" <alan.buxey@gmail.com> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html