perhaps using hunt-groups ? Victor Ors - Agh Sistemas - Infraestructuras de red cableadas y wifi Av Alay 3, 29630 Benalmadena Costa, Malaga, Spain Tel.: +34 952 441 147 Averias 24h.:+34 654 94 86 94 http://www.aghsistemas.com AVISO LEGAL: CLÁUSULA DE CONFIDENCIALIDAD (AGH SISTEMAS) Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener información confidencial o legalmente protegida (LOPD 15/1999 de 13 de Diciembre), siendo para uso exclusivo del destinatario. No hay renuncia a la confidencialidad o secreto profesional por cualquier transmisión defectuosa o errónea, y queda expresamente prohibida su divulgación, copia o distribución a terceros sin la autorización expresa del remitente. Si ha recibido este mensaje por error o no desea recibir información comercial, se ruega lo notifique al remitente enviando un mensaje al correo electrónico, con el asunto (dar de baja o no deseo recibir información comercial),ventas@aghsistemas.com y proceda inmediatamente al borrado del mensaje original y de todas sus copias. Gracias por su colaboración 2014-11-06 23:15 GMT+01:00 Ilavajuthy Palanisamy <ilavajuthy@gmail.com>:
Hello All,
As suggested in earlier replies I have modified the sql query and the schema. We are trying to use NAS-Identifier to segregate the customers.
However I am running into an issue when trying to authenticate user using PEAP MSCHAP.
While sending the tunneled request, its not containing the NAS-Identifier. Is it possible to send the NAS-Identifier in the tunneled request?
I am using freeradius version 2.1.12
Please let me know if there is something wrong with my config.
FreeRadius LOG (i have removed many log output lines to reduce the size of the mail)
--------------------------------------------------------------------------------------------------------------------
rad_recv: Access-Request packet from host 192.168.1.62 port 32953, id=154, length=226
Acct-Session-Id = "eaea9572-00000065"
NAS-Port = 95
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "CN3BD321SM"
NAS-IP-Address = 192.168.1.62
Framed-MTU = 1496
User-Name = "radtest"
Calling-Station-Id = "F0-25-B7-48-08-2C"
Called-Station-Id = "A0-D3-C1-AB-71-62"
Service-Type = Framed-User
EAP-Message = 0x025a000c0172616474657374
Colubris-AVPair = "ssid=tenant"
Colubris-AVPair = "phytype=IEEE802dot11 "
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0xb9bfc73c2e480450d46170ae43dc7721
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 90 length 12
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[sql] expand: %{User-Name} -> radtest
[sql] sql_set_user escaped user --> 'radtest'
rlm_sql (sql): Reserving sql socket id: 3
[sql] expand: SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck, nasgroup WHERE Username = '%{SQL-User-Name}' AND nasgroup.nasid = '%{NAS-Identifier}' AND nasgroup.groupname = radcheck.Groupname ORDER BY radcheck.id -> SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck, nasgroup WHERE Username = 'radtest' AND nasgroup.nasid = 'CN3BD321SM' AND nasgroup.groupname = radcheck.Groupname ORDER BY radcheck.id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 5
[sql] User found in radcheck table
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'radtest' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='radtest' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 1
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set. Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type md5
rlm_eap_md5: Issuing Challenge
++[eap] returns handled
Sending Access-Challenge of id 154 to 192.168.1.62 port 32953
EAP-Message = 0x015b00160410c29fa2a1e7b48d23a6e801c718e9f7a7
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x005655b7000d519bfcf3bbcabb4eb013
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.62 port 32953, id=77, length=238
Acct-Session-Id = "eaea9572-00000065"
NAS-Port = 95
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "CN3BD321SM"
NAS-IP-Address = 192.168.1.62
Framed-MTU = 1496
User-Name = "radtest"
Calling-Station-Id = "F0-25-B7-48-08-2C"
Called-Station-Id = "A0-D3-C1-AB-71-62"
Service-Type = Framed-User
EAP-Message = 0x025b00060319
State = 0x005655b7000d519bfcf3bbcabb4eb013
Colubris-AVPair = "ssid=tenant"
Colubris-AVPair = "phytype=IEEE802dot11 "
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0x9815cb4c5cca3bcebc15d622c5f9e0f9
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 91 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[sql] expand: %{User-Name} -> radtest
[sql] sql_set_user escaped user --> 'radtest'
rlm_sql (sql): Reserving sql socket id: 2
[sql] expand: SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck, nasgroup WHERE Username = '%{SQL-User-Name}' AND nasgroup.nasid = '%{NAS-Identifier}' AND nasgroup.groupname = radcheck.Groupname ORDER BY radcheck.id -> SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck, nasgroup WHERE Username = 'radtest' AND nasgroup.nasid = 'CN3BD321SM' AND nasgroup.groupname = radcheck.Groupname ORDER BY radcheck.id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 5
[sql] User found in radcheck table
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'radtest' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='radtest' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 1
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set. Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/peap
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 77 to 192.168.1.62 port 32953
EAP-Message = 0x015c00061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x005655b7010a4c9bfcf3bbcabb4eb013
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.62 port 32953, id=213, length=440
Acct-Session-Id = "eaea9572-00000065"
NAS-Port = 95
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "CN3BD321SM"
NAS-IP-Address = 192.168.1.62
Framed-MTU = 1496
User-Name = "radtest"
Calling-Station-Id = "F0-25-B7-48-08-2C"
Called-Station-Id = "A0-D3-C1-AB-71-62"
Service-Type = Framed-User
EAP-Message = 0x025c00d01980000000c616030100c1010000bd0301545bede983c64b84e5579021f2c8c1bba854b49152249d40e262132606fb4d13000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011
State = 0x005655b7010a4c9bfcf3bbcabb4eb013
Colubris-AVPair = "ssid=tenant"
Colubris-AVPair = "phytype=IEEE802dot11 "
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0x1981daace80a8b50b267b588801fa7c6
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 92 length 208
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.62 port 32953, id=247, length=238
Acct-Session-Id = "eaea9572-00000065"
NAS-Port = 95
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "CN3BD321SM"
NAS-IP-Address = 192.168.1.62
Framed-MTU = 1496
User-Name = "radtest"
Calling-Station-Id = "F0-25-B7-48-08-2C"
Called-Station-Id = "A0-D3-C1-AB-71-62"
Service-Type = Framed-User
EAP-Message = 0x025d00061900
State = 0x005655b7020b4c9bfcf3bbcabb4eb013
Colubris-AVPair = "ssid=tenant"
Colubris-AVPair = "phytype=IEEE802dot11 "
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0x3194e87ace606247da24d510ebdbb259
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 93 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 94 length 144
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.62 port 32953, id=3, length=238
Acct-Session-Id = "eaea9572-00000065"
NAS-Port = 95
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "CN3BD321SM"
NAS-IP-Address = 192.168.1.62
Framed-MTU = 1496
User-Name = "radtest"
Calling-Station-Id = "F0-25-B7-48-08-2C"
Called-Station-Id = "A0-D3-C1-AB-71-62"
Service-Type = Framed-User
EAP-Message = 0x025f00061900
State = 0x005655b704094c9bfcf3bbcabb4eb013
Colubris-AVPair = "ssid=tenant"
Colubris-AVPair = "phytype=IEEE802dot11 "
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0xf14dd2f6c72a4c3ceb5375a80413b223
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 95 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 3 to 192.168.1.62 port 32953
EAP-Message = 0x0160002b190017030100206f520d286e0a8531cad4f96f3d16ff71290206fbd472476c97983544bf77ce37
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x005655b705364c9bfcf3bbcabb4eb013
Finished request 5.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.62 port 32953, id=137, length=312
Acct-Session-Id = "eaea9572-00000065"
NAS-Port = 95
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "CN3BD321SM"
NAS-IP-Address = 192.168.1.62
Framed-MTU = 1496
User-Name = "radtest"
Calling-Station-Id = "F0-25-B7-48-08-2C"
Called-Station-Id = "A0-D3-C1-AB-71-62"
Service-Type = Framed-User
EAP-Message = 0x0260005019001703010020be7393b22523f27ba53a2a90ae5022b7e6ac7a1733cbb1d10ea97dc3871c60001703010020e0e4b12bd1ad0ad1918c19eb36449ea6e0a94e322f9aeacee86bf5db4613e7e1
State = 0x005655b705364c9bfcf3bbcabb4eb013
Colubris-AVPair = "ssid=tenant"
Colubris-AVPair = "phytype=IEEE802dot11 "
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0xd3c41c6be1d9c598f08c4b289f092589
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 96 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - radtest
[peap] Got inner identity 'radtest'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
EAP-Message = 0x0260000c0172616474657374
server {
[peap] Setting User-Name to radtest
Sending tunneled request
EAP-Message = 0x0260000c0172616474657374
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "radtest"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "radtest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 96 length 12
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> radtest
[sql] sql_set_user escaped user --> 'radtest'
rlm_sql (sql): Reserving sql socket id: 1
[sql] expand: SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck, nasgroup WHERE Username = '%{SQL-User-Name}' AND nasgroup.nasid = '%{NAS-Identifier}' AND nasgroup.groupname = radcheck.Groupname ORDER BY radcheck.id -> SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op FROM radcheck, nasgroup WHERE Username = 'radtest' AND nasgroup.nasid = '' AND nasgroup.groupname = radcheck.Groupname ORDER BY radcheck.id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='radtest' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 1
rlm_sql (sql): Released sql socket id: 1
[sql] User radtest not found
++[sql] returns notfound
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
----------------------------------------------------------------------------------------------------------------------------------------
Database schema changes -
----------------------------------------
A new table has been added called "nasgroup" and the radcheck table has been modified to include an extra column called groupname -
radiusdb=# select * from nasgroup;
id | groupname | nasid
----+-----------+------------
1 | test | CN3BD321SM
3 | temp | XYZABDG
radiusdb=# select * from radcheck;
id | username | attribute | op | value | groupname
----+----------+--------------------+----+---------+-----------
1 | radtest | Cleartext-Password | := | radtest | test
2 | radtest | Cleartext-Password | := | radtest | temp
Dialup.conf
---------------
"authorize_check_query" has been modified but "authorize_reply_query" has not been changed.
authorize_check_query = "SELECT ${authcheck_table}.id, ${authcheck_table}.UserName, ${authcheck_table}.Attribute, ${authcheck_table}.Value, ${authcheck_table}.Op \
FROM ${authcheck_table}, nasgroup \
WHERE Username = '%{SQL-User-Name}' \
AND nasgroup.nasid = '%{NAS-Identifier}' \
AND nasgroup.groupname = ${authcheck_table}.Groupname \
ORDER BY radcheck.id"
authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op \
FROM radreply \
WHERE Username = '%{SQL-User-Name}' \
ORDER BY id"
Thanks,
Ila.
On Mon, Oct 27, 2014 at 4:36 PM, Pshem Kowalczyk <pshem.k@gmail.com> wrote:
Hi,
One method that I used in the past is to create a virtual server per 'tenant' and then use the 'main' server to proxy to the correct virtual server based on the attributes in the requests.
kind regards Pshem
On 28 October 2014 07:09, Ilavajuthy Palanisamy <ilavajuthy@gmail.com> wrote:
Hi All,
We are hosting an application in the cloud which is managing multiple customers. Customers will be authenticated using the FreeRadius server. We are planning to use the user authentication through the database(PostgreSQL). I have configured the radcheck table and able to make the user authentication successfully.
In order to support multiple customers, what are all the options/design available in FreeRadius.
One option we are thinking is to modify the schema to introduce customer-id and modify the sql module to support the new schema. If this is possible, please provide pointers in achieving this.
If there are other options available, please provide pointers.
Thanks, Ila.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html