Re: freeradius proxying directions..

9 Jan 2019


      Alan, Thank you for the information. sadly i couldn't accomplish it.

i have played a little with the configuration and got it partially working.
i noticed a bug, in which, even if radius server is down, access is
granted..
can someone identify the bug for me and explain how to modify the script to
correct it?
authorize {
        if (!State) {
                if (&User-Password) {
                        # If !State and User-Password (PAP), then force
LDAP:
                        update control {
                                Ldap-UserDN := "%{User-Name}@domain.com"
                                Auth-Type := LDAP
                        }
                }
                else {
                        reject
                }
        }
        else {
                # If State, then proxy request:
                update control {
                        Proxy-To-Realm := "proxy-test"
                }
        }
}

authenticate {
        Auth-Type LDAP {
                # Attempt authentication with a direct LDAP bind:
                ldap
                if (ok) {
update request {
User-Password := p
}
update control {
                       Proxy-To-Realm := "proxy-test"
                }
accept
                }
        }
}

pre-proxy {
        # Enable pre-proxy to filter State attribute from proxied requests:
        attr_filter.pre-proxy
}


}


On Mon, Jan 7, 2019 at 3:39 PM Alan DeKok <aland@deployingradius.com> wrote:
...
On Jan 6, 2019, at 10:16 AM, Tom Mustaki <tom@mustaki.com> wrote:
...
i am a noob in the freeradius business and really need some basic
guidance.
i was following an article:
https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
and it worked fine.
That's good.
...
now my goal is to support push notification on mobile devices.
(the freeradius should proxy the request without waiting for OTP input
from
the authenticating user.)
instead the freeradius should, after successful LDAP bind,  send
username +
p for password, to the OTP radius. that will trigger a push notification
on
the mobile device.
could anyone point me in the right direction on where and what to change?
The server can't do proxying *and* local authentication at the same
time.  But with a bit of minor configuration, it should work.
The simple solution is to *not* set Auth-Type = LDAP.  You should be
able to do something like:
authorize {
        ...
        ldap.authenticate       # run LDAP bind
        if (ok) {
                update control {
                        Proxy-To-Realm := "realm"
                }
        }
        ...
}
Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html