On Feb 10, 2018, at 5:26 AM, Nathan Ward <lists+freeradius@daork.net> wrote:
I’m working on a solution where I need to auth differently, and return different attributes based on a user’s access type. I can see the interface that a user has arrived on, and from that look up the access type. We have maybe 100 different interfaces which can change a bit, divided in to 3 or 4 different access types. Once I know the access type, I can choose which of the other attributes I use to authenticate the user. We run 3.0.16 (or will by the time this is deployed).
I’m trying to figure out a good way to map those 100 interfaces to access types, without a change meaning a restart.
We run LDAP right now, we don’t have SQL servers running on our front end servers, and I’d rather avoid it.
Right now, I’m considering SQLite, but I’m not certain how it would handle: 1) A 3rd party process opening the db file to write periodically - I see posts about only one writer, and that’s fine I only want one writer, but I want to write from a different application.. is that OK?
Yes.
2) Changes to the file, would they require a restart - I presume the DB file is not cached in memory in FreeRADIUS somehow, but that’s just a guess.
They won't require a restart. If the updates are fast (i.e. sub millisecond), it won't really affect the server much.
Our auth load is quite manageable, so, if a request blocked for a second or two while the write was happening that would be OK - but errors/false negatives would be bad.
Updates should be less than 1ms in the normal case.
Can anyone help with these before I go spending a bunch of time testing?
Any other solutions I should consider? A server restart is always an option, but, I’d rather avoid it if possible.
rlm_passwd can do this, too. See "man rlm_passwd" Alan DeKok.