cache entry time

4 Apr 2024

      Hi

The freeradius is used as radius proxy to proxy radius auth request to
backend NPS server for MFA.

The scenario we would like to achieve is the following:
1. client sends username/OTP to freeradius-proxy that relays to NPS
server. NPS server accepts and replies to freeradius-proxy that relays
to the client.

2. client sends same username/OTP within TTL to freeradius-proxy that
accepts and replies to client.

with the following config, I can make the scenario work, but I notice
the cache entry TTL is timed when radius client sends radius auth
request, not the time when user finishes OTP response. For example,
user logins at 9:05:12AM and finish OTP/MFA at 9:05:34AM. The cache
TTL is timed at 9:05:12AM. Which config should be adjusted to make the
cache time correct?

Regards,
Eric

### customization
cache otpcache {
        # note - we need to escape the key values
        # otherwise the client can perform injection/overlap
        # attacks by modifying their username
        driver = "rlm_cache_rbtree"
        key = "%{sha256:%{User-Name}}/%{sha256:%{User-Password}}/%{sha256:%{MS-Machine-Name}}/%{sha256:%{Calling-Station-Id}}"
        ttl = 120
        update {
                # <list>:<attribute> <op> <value>

                # Cache all instances of Reply-Message in the reply list
                &reply:Reply-Message += &reply:Reply-Message[*]

                # Add our own to show when the cache was last updated
                &reply:Reply-Message += "Cache last updated at %t"
        }
}
### end of customization

authorize {
        ### customization
        # first, just check the cache, don't
        # create entries or set reply attrs
        update control {
                Cache-Status-Only = yes
        }
        otpcache

        if (ok) {
        # entry found in cache; set auth type to accept
        # and call cache again to get reply attrs
                update control {
                        Cache-Status-Only !* ANY
                }
                accept
                otpcache
                ok
        }
        else {
        # future cache lookups here, and in post-auth,
        # should be normal ones
                update control {
                        Cache-Status-Only !* ANY
                }
        }
        ### end of customization
}

post-auth {
        ### customization
        if (control:Auth-Type == Accept) {
                # first, delete any existing cache entries
                update control {
                        Cache-TTL = 0
                }

                # clear that variable
                update control {
                        Cache-TTL !* ANY
                }

                # now cache the reply
                otpcache
        }
        ### end of customization
}

cache entry time

Eric Lin