I’m CERTAINLY no expert in this, but I can hopefully point you in the right direction.

 

There is some doc within the FR install (and the Wiki I think) about writing your own “modules” – I think this is what you want.  Although, I think you can do pretty much anything with rlm_perl and unlang, but nonetheless – yes, you can write your own auth module.  I don’t thik it would be a separate “listener”, but just another module FR uses to auth RADIUS requests.  Ie:  instead of FR using RLM_LDAP, EAP, unix, ntlm_auth, etc. – it would use “Travis_Auth”.

 

Not sure if that helps.  If you can’t find doc on “modules” LMK and I’ll see if I can track it down for you.  From what I remember it’s not rocket science, but not trivial either.

 

G

 

 

I have a problem scenario where I need to be able to handle the authentication of users myself.  I am looking into using either rlm_perl or (preferably) rlm_jradius to be able to write my own piece to do authentication.  I believe this is possible with either module (please correct me if I’m wrong on that, it would stop me in my tracks).  What I need to know is if when writing my own authenticator there is a terribly complicated process of requests and responses that I have to honor in order to make the supplicant happy, or if I can trivially accept or reject based on the parameters of my business problem.  As a test case, I wrote a Java class for rlm_jradius that just replaced reject packets with accept packets, to see if it would work.  I found that if I hooked into it at the ‘post_auth’ stage it didn’t matter what my reply was, freeRadius remembered that auth had failed and stripped all the attributes from the response packet.

 

That was long winded, here is a summary of my questions.  Can I write my own piece to do authentication?  Where in the freeRadius process do I list that listener?  Is there a series of requests and responses that I have to honor?

 

-Travis