Hello, is that implemented in FR, be it 1.1 or 2.0? According to http://wiki.freeradius.org/RFC it shouldn't be. From my reading of the RFC, defining it "by hand" in radreply is not considered good enough, because it has a specific logic behind it: (2.1) If a home RADIUS server that supports the CUI attribute receives an Access-Request packet containing a CUI (set to nul or otherwise), it MUST include the CUI attribute in the Access-Accept packet. Otherwise, if the Access-Request packet does not contain a CUI, the home RADIUS server SHOULD NOT include the CUI attribute in the Access-Accept packet. The Access-Request may be sent either in the initial authentication or during re-authentication. So, always sending it via radreply would ignore the SHOULD NOT. Not defining it at all though makes it difficult for the server to maintain a persistent yet anonymous handle. So something like defining it by hand but only including it if it was asked for would be needed. Is that logic present in FR? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Stefan Winter wrote:
is that implemented in FR, be it 1.1 or 2.0? According to http://wiki.freeradius.org/RFC it shouldn't be.
It's in the dictionaries...
From my reading of the RFC, defining it "by hand" in radreply is not considered good enough, because it has a specific logic behind it:
(2.1)
If a home RADIUS server that supports the CUI attribute receives an Access-Request packet containing a CUI (set to nul or otherwise), it MUST include the CUI attribute in the Access-Accept packet.
That can be done via policy logic in "unlang". if ("%{Chargeable-User-Identifier}") { update reply { Chargeable-User-Identifier = .... } }
So, always sending it via radreply would ignore the SHOULD NOT. Not defining it at all though makes it difficult for the server to maintain a persistent yet anonymous handle. So something like defining it by hand but only including it if it was asked for would be needed. Is that logic present in FR?
Nope. It's 4 lines of text, as above. The only complexity is *creating* it, and mapping it to a known user. This can be done via additional logic, and stored in SQL, for example. Alan DeKok.
Alan DeKok pisze:
Stefan Winter wrote:
(2.1)
If a home RADIUS server that supports the CUI attribute receives an Access-Request packet containing a CUI (set to nul or otherwise), it MUST include the CUI attribute in the Access-Accept packet.
That can be done via policy logic in "unlang".
if ("%{Chargeable-User-Identifier}") { update reply { Chargeable-User-Identifier = .... } }
According to RFC4372 CUI attribute in request can include a single NUL character, then your test if ("%{Chargeable-User-Identifier}") { update reply { Chargeable-User-Identifier = .... } } evaluates to false. The only way I've found to handle such a situation (nul CUI or CUI!="") is to check the total number of attributes of the name Chargeable-User-Identifier, when this number is not 0 then the CUI is set: if ("%{Chargeable-User-Identifier[#]}" > 0) { update reply { Chargeable-User-Identifier = .... } } Maja Gorecka-Wolniewicz -- Maja Gorecka-Wolniewicz mgw@umk.pl http://www.umk.pl/~mgw PGP key: http://www.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
Maja Wolniewicz wrote:
According to RFC4372 CUI attribute in request can include a single NUL character, then your test if ("%{Chargeable-User-Identifier}") { update reply { Chargeable-User-Identifier = .... } } evaluates to false.
I've fixed this in CVS head (2.0.1-pre), added better type-checking, and removed the requirement to always convert everything to strings: if (Chargeable-User-Identifier == "") { ... if (Framed-IP-Address > 127.0.0.1) { ... ~200 lines of code: big administrator happiness. :) Alan DeKok.
Alan DeKok pisze:
Maja Wolniewicz wrote:
According to RFC4372 CUI attribute in request can include a single NUL character, then your test if ("%{Chargeable-User-Identifier}") { update reply { Chargeable-User-Identifier = .... } } evaluates to false.
I've fixed this in CVS head (2.0.1-pre), added better type-checking, and removed the requirement to always convert everything to strings:
if (Chargeable-User-Identifier == "") { ...
if (Framed-IP-Address > 127.0.0.1) { ...
~200 lines of code: big administrator happiness. :)
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html I'm now running freeradius from CVS FreeRADIUS Version 2.0.1-pre
in post-auth I have: if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") { if ("%{Chargeable-User-Identity}") { update reply { Chargeable-User-Identity:="%{reply:Chargeable-User-Identity}@%{Realm}" } } else { update reply { Chargeable-User-Identity-="%{reply:Chargeable-User-Identity}" } } } and it still doesn't work for me: when Chargeable-User-Identity in request has a nul value, I'm getting: ++? if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") expand: %{FreeRADIUS-Proxied-To} -> 127.0.0.1 ? Evaluating ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") -> TRUE ++? if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") -> TRUE ++- entering if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") +++? if ("%{Chargeable-User-Identity}") expand: %{Chargeable-User-Identity} -> ? Evaluating ("%{Chargeable-User-Identity}") -> FALSE +++? if ("%{Chargeable-User-Identity}") -> FALSE +++- entering else else expand: %{reply:Chargeable-User-Identity} -> when Chargeable-User-Identity in request is AAA ++? if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") -> TRUE ++- entering if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") +++? if ("%{Chargeable-User-Identity}") expand: %{Chargeable-User-Identity} -> AAA ? Evaluating ("%{Chargeable-User-Identity}") -> TRUE +++? if ("%{Chargeable-User-Identity}") -> TRUE +++- entering if ("%{Chargeable-User-Identity}") expand: %{reply:Chargeable-User-Identity}@%{Realm} -> xx@umk.pl Maja -- Maja Gorecka-Wolniewicz mgw@umk.pl http://www.umk.pl/~mgw PGP key: http://www.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
Maja Wolniewicz wrote:
I'm now running freeradius from CVS FreeRADIUS Version 2.0.1-pre
in post-auth I have: if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") { if ("%{Chargeable-User-Identity}") {
Please fix this. Putting double quotes around *everything* was never necessary, and is much less necessary in 2.0.1. See the examples from my original message, and in "man unlang". What you want is: if (FreeRADIUS-Proxied-To == 127.0.01) { ... if (Chargeable-User-Identity) { ...
update reply { Chargeable-User-Identity:="%{reply:Chargeable-User-Identity}@%{Realm}" }
Huh? You're updating the reply attribute with the reply attribute? What do you think this is doing?
and it still doesn't work for me:
Perhaps you could explain why you think it should do *anything* useful.
when Chargeable-User-Identity in request has a nul value, I'm getting: ... expand: %{Chargeable-User-Identity} -> ? Evaluating ("%{Chargeable-User-Identity}") -> FALSE
Update this to use my example above. See also "man unlang": If the word ’foo’ is not a quoted string, then it can be taken as a reference to a named attribute. See "Referencing attribute lists", below, for examples of attribute references. The condi‐ tion evaluates to true if the named attribute exists. This *is* documented. I *did* say I had updated the documentation. Alan DeKok.
Alan DeKok pisze:
Maja Wolniewicz wrote:
I'm now running freeradius from CVS FreeRADIUS Version 2.0.1-pre
in post-auth I have: if ("%{FreeRADIUS-Proxied-To}" == "127.0.0.1") { if ("%{Chargeable-User-Identity}") {
Please fix this. Putting double quotes around *everything* was never necessary, and is much less necessary in 2.0.1. See the examples from my original message, and in "man unlang". Thanks. Now it works.
What you want is:
if (FreeRADIUS-Proxied-To == 127.0.01) { ... if (Chargeable-User-Identity) { ...
update reply { Chargeable-User-Identity:="%{reply:Chargeable-User-Identity}@%{Realm}" }
Huh? You're updating the reply attribute with the reply attribute? What do you think this is doing? Yes, I want to add current realm to reply attribute Chargeable-User-Identity which comes form LDAP. When Chargeable-User-Identity attribute isn't present in request I want to remove Chargeable-User-Identity from reply. if (Chargeable-User-Identity) { update reply {
Chargeable-User-Identity:="%{reply:Chargeable-User-Identity}@%{Realm}" } } else { update reply { Chargeable-User-Identity-="%{reply:Chargeable-User-Identity}" } } What is wrong in it? Maja
and it still doesn't work for me:
Perhaps you could explain why you think it should do *anything* useful.
when Chargeable-User-Identity in request has a nul value, I'm getting: ... expand: %{Chargeable-User-Identity} -> ? Evaluating ("%{Chargeable-User-Identity}") -> FALSE
Update this to use my example above. See also "man unlang":
If the word 'foo' is not a quoted string, then it can be taken as a reference to a named attribute. See "Referencing attribute lists", below, for examples of attribute references. The condi- tion evaluates to true if the named attribute exists.
This *is* documented. I *did* say I had updated the documentation.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Maja Gorecka-Wolniewicz mgw@umk.pl http://www.umk.pl/~mgw PGP key: http://www.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
Maja Wolniewicz wrote:
Thanks. Now it works.
That's good to hear.
Yes, I want to add current realm to reply attribute Chargeable-User-Identity which comes form LDAP. When Chargeable-User-Identity attribute isn't present in request I want to remove Chargeable-User-Identity from reply.
There's a simple answer: don't add something if it's not needed. Adding it and then deleted it is complicated, and prone to errors. Instead, add it *only* if it's necessary. This may involve update the LDAP maps to use a temporary attribute. e.g. map the LDAP data to "My-Chargeable-User-Identity", and then map that to Chargeable-User-Identity only when necessary. See raddb/dictionary for how to define local attributes like this. Alan DeKok.
Alan DeKok pisze:
Maja Wolniewicz wrote:
Thanks. Now it works.
That's good to hear.
Yes, I want to add current realm to reply attribute Chargeable-User-Identity which comes form LDAP. When Chargeable-User-Identity attribute isn't present in request I want to remove Chargeable-User-Identity from reply.
There's a simple answer: don't add something if it's not needed. Adding it and then deleted it is complicated, and prone to errors.
Instead, add it *only* if it's necessary. This may involve update the LDAP maps to use a temporary attribute. e.g. map the LDAP data to "My-Chargeable-User-Identity", and then map that to Chargeable-User-Identity only when necessary.
See raddb/dictionary for how to define local attributes like this.
That's right. Thanks for help, Maja
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Maja Gorecka-Wolniewicz mgw@umk.pl http://www.umk.pl/~mgw PGP key: http://www.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
participants (3)
-
Alan DeKok -
Maja Wolniewicz -
Stefan Winter