On Mar 18, 2020, at 11:18 AM, Thomas Manninger <DBGTMaster@gmx.at> wrote
I confiured two virutal servers, one for X802.1 network authentication
(name: inner-tunnel), another virtual server with PAP username/password authentication (name: keycloak).
Every incoming request should processed by the virtual_server "keycloak-auth", except all X802.1 request should be processed to the virtual_server "inner-tunnel".
That’s not how virtual servers work. The listen section has no configuration which tells the server to do that.
But all requests, also the X802.1 requests, are processed by the virtual_server keycloak.
Yes, that’s how virtual server work.
If i unterstand it correctly, the eap module should send all EAP requests to the inner-tunnel, but this in not working :-( ...
No, the eap module will send “inner” authentication data to the inner-tunnel virtual server. But the eap module still has to run in a separate virtual server. The default examples and comments explain this fairly well.
Only if i send all requests to the inner-tunnel virtual-server, then X802.1 auth is working
How can i fix the issue?
Configure the server correctly. Add the eap module to the “outer” virtual server. The default configuration does this for a reason. There’s no documentation which says that the “listen” sections work like you want.
My listen configuration:
listen { type = auth ipaddr = * port = 0 virtual_server = keycloak }
There’s no magic there which says “run eap through a different virtual server”