On Feb 9, 2016, at 8:35 PM, Jim Whitescarver <jimscarver@gmail.com> wrote:
for jim the password is arbitrary as I am not checking it at this point in the python. The authentication will be done out-of-band by the plugin. Before trying my script I want to get the example script to just always authenticate. Then I will add the code for out-of-band authentication.
I see ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
Because you didn't tell the server how to authenticate the user. You'll need to do one of two things. Either do all the work in "authorize", and set "Auth-Type = Accept" for successful authentication, or (preferred) do the authentication in the "authenticate" section. But there, you'll also need to force "Auth-Type = my-python-script", and put the relevant configuration into "authenticate". It's best to use the sections the way they are intended.
I included python in the authorize section per the instructions but it is not in the authenticate section of sites-enabled/default, I suspect that may be an issue but I do not know where/how to put it.
Simple: authenticate { ... Auth-Type my-python-script { python } ... } And it will call the authenticate method of your python script. The downside here is that this works *only* for PAP authentication. For CHAP, MS-CHAP, EAP, etc., you really want to let FreeRADIUS authenticate the user. Alan DeKok.