This is a pretty big project. I suspect, these are paying subscribers. Not some type of open net work to provide free Internet to the masses. In this particular case, I would suggest you actually pay for support from the commercial side of free radius. They can design you a pretty good solution. Although I’ve never used them for support, a couple of my clients have. They cannot say enough about the support they receive. It’s all been positive. I am willing to bet you the money you spend on initial consult plus a year of support will save you much much more then the time that you’re going to need to get this project going. Now, to your original problem. Can free radius do what you want to? Yes. How do you do that? Well, there are a lot more questions you’re gonna have to ask before you get a good answer on that. Not trying to me mean or snarky here. I’ve just gotten to the point where my time is very valuable. I guess that comes with becoming an old fart. Pay someone to help you designed this. You will have a lot less headaches and be happier at the end. John On Sun, Jun 19, 2022 at 08:56 Alan DeKok <aland@deployingradius.com> wrote:
On Jun 18, 2022, at 11:51 PM, Cecil Wei <cecilwei@gmail.com> wrote:
I am trying to build a platform that provides MAC authentication service to multiple organizations. There will be a captive portal for end user to register their device MAC address. The administrator of an organization can also upload a list of MAC addresses to the database. It might be possible that the same user MAC address appears in multiple organizations. In this case multiple tenants might be selected if we lookup by MAC address.
You're going to have a very hard time building this. The first reason is because you've promised people a solution, without understanding the problem (or what's possible). The second is because I asked specific, and detailed questions about what your needs were. Those questions were ignored.
I'm trying to understand what the requirements are, in order to help you. By not answering, you're not working towards a solution.
I am also thinking of providing EAP authentication to multiple organizations and allow them to have their own root certificate. My understanding for this requirement is that I will need to create multiple EAP configurations.
So instead of understanding the problem, you're going to try another random solution. Which may or may not help. But you're not sure.
I thought that virtual server can help on providing proper data isolation and individual EAP configuration.
The virtual server documentation makes it clear what virtual servers are for. You can read the documentation to see whether or not you need different virtual servers.
Could you share some best practices for the problems I mentioned above if there are over 10,000 organizations?
Understand the problem. Read the documentation. When you ask for help, do what people say.
You need to take a step back, write down the requirements, write down what's possible, and then try to *understand* what's going on. You're just not going to solve anything by changing random things in random configuration files.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html