Adrian Heath <adrian.heath@tracktrans.com> wrote:
Installed an evaluation version of SteelBelt Radius (Vodafone's recommended solution) and their test connection worked. Configured FreeRadius to return same attributes and Vodafone's test connection failed although FreeRadius sent back an accepted authentication.
The Access-Accept isn't the issue. The packet contents are. If you configure FreeRADIUS to return *exactly* the same response as any other RADIUS server, the clients will behave *exactly* the same.
The default SBR configuration file replaces something in the Class attribute included in the response with the User-Name attribute value. How do I configure FreedRadius to do the same?
First, you need to define what you want to do. "Something" is vague enough to be useless.
SBR returns Class attribute that starts 'SBR2 CL' and then binary characters. The User-Name attribute is included somewhere in the rest of the string as changing the length of the User-Name in the request varies the length of the Class response by the same number of characters.
Is this needed by the RADIUS client? I don't see why. Try looking at ALL of the attributes returned by SBR, and then make FreeRADIUS return the same things. For testing purposes, you can try one username, and make FreeRADIUS sned back the Class attribute returned by SBR for that user. If that works, you're OK. Then, start changing things. If it stops working, you'll know why, want what changed. Alan DeKok.