Config hints for providing list of groups in post-auth?
Hello list: I have a 3.0.4 machine successfully authenticating against Active Directory. For the use case I have in mind I'd like to have the Freeradius server add into post-auth something like: Group-Name:= "Domain Users", Group-Name+= "All Staff", etc. The idea here is that the NAS will be able to make its own decisions about what to grant based on group membership once radius has authenticated the user. I can parse the group list easily enough from the shell, but don't know how to get this into post-auth. Also, is Group-Name the best choice here or should I be using another attribute? Thanks greatly, Mike
On Jun 6, 2016, at 2:29 PM, Mike Ely <me@mikeely.org> wrote:
I have a 3.0.4 machine successfully authenticating against Active Directory. For the use case I have in mind I'd like to have the Freeradius server add into post-auth something like:
Group-Name:= "Domain Users", Group-Name+= "All Staff", etc.
Those are server-side attributes, and can't go into a RADIUS packet.
The idea here is that the NAS will be able to make its own decisions about what to grant based on group membership once radius has authenticated the user.
The NAS has to support this functionality. If the NAS doesn't support it, then it's impossible.
I can parse the group list easily enough from the shell, but don't know how to get this into post-auth. Also, is Group-Name the best choice here or should I be using another attribute?
See your NAS documentation for how the NAS works. If you're writing your own NAS, use a vendor-specific dictionary to define your own group attribute. Alan DeKok.
On 06/06/2016 11:35 AM, Alan DeKok wrote:
On Jun 6, 2016, at 2:29 PM, Mike Ely <me@mikeely.org> wrote:
I have a 3.0.4 machine successfully authenticating against Active Directory. For the use case I have in mind I'd like to have the Freeradius server add into post-auth something like:
Group-Name:= "Domain Users", Group-Name+= "All Staff", etc. Those are server-side attributes, and can't go into a RADIUS packet. Good to know.
The idea here is that the NAS will be able to make its own decisions about what to grant based on group membership once radius has authenticated the user. The NAS has to support this functionality. If the NAS doesn't support it, then it's impossible. We have full control over the NAS and what it supports.
I can parse the group list easily enough from the shell, but don't know how to get this into post-auth. Also, is Group-Name the best choice here or should I be using another attribute? See your NAS documentation for how the NAS works.
If you're writing your own NAS, use a vendor-specific dictionary to define your own group attribute.
Alan DeKok.
Excellent - the dictionary part seems straightforward. What I'm wondering is how to get the group membership from the OS into a radius packet. Is there some kind of command from unlang that can execute a shell command? I'm hoping for something along the lines of "exec mycommand.sh username" that returns an array of variables, in this case the list of group names.
On Jun 6, 2016, at 2:40 PM, Mike Ely <me@mikeely.org> wrote:
What I'm wondering is how to get the group membership from the OS into a radius packet. Is there some kind of command from unlang that can execute a shell command? I'm hoping for something along the lines of "exec mycommand.sh username" that returns an array of variables, in this case the list of group names.
$ man unlang This is documented. Alan DeKok.
Are you referring to backticks? Outside that, I couldn't find a hint in "man unlang" (after reading it front to back three times) that made reference to external shell scripts. Also, what's the method for passing the array into unlang - the equivalent to ARGV? On 06/06/2016 11:46 AM, Alan DeKok wrote:
On Jun 6, 2016, at 2:40 PM, Mike Ely <me@mikeely.org> wrote:
What I'm wondering is how to get the group membership from the OS into a radius packet. Is there some kind of command from unlang that can execute a shell command? I'm hoping for something along the lines of "exec mycommand.sh username" that returns an array of variables, in this case the list of group names. $ man unlang
This is documented.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 6, 2016, at 6:36 PM, Mike Ely <me@mikeely.org> wrote:
Are you referring to backticks? Outside that, I couldn't find a hint in "man unlang" (after reading it front to back three times) that made reference to external shell scripts.
Yes. Most of what you're doing can be done in "unlang". Or, running an external program can be done in a module. See the "exec" module, or the "ntlm_auth" module for examples
Also, what's the method for passing the array into unlang - the equivalent to ARGV?
You can't pass arrays. See the "exec" module for examples. Alan DeKok.
On 06/06/2016 04:07 PM, Alan DeKok wrote:
On Jun 6, 2016, at 6:36 PM, Mike Ely <me@mikeely.org> wrote:
Are you referring to backticks? Outside that, I couldn't find a hint in "man unlang" (after reading it front to back three times) that made reference to external shell scripts. Yes.
Most of what you're doing can be done in "unlang". Intriguing. Are you aware of a way in "unlang" to pull all of a user's group memberships and present those in the reply to the NAS? It would certainly be easier to maintain compared to calling an external script.
On Jun 7, 2016, at 11:52 AM, Mike Ely <me@mikeely.org> wrote:
Intriguing. Are you aware of a way in "unlang" to pull all of a user's group memberships and present those in the reply to the NAS? It would certainly be easier to maintain compared to calling an external script.
In v3.0.x, you might as well use a shell script. In v3.1.x (git only), you can do all of that natively in "unlang". See the "map" function in unlang. Alan DeKok.
On 06/07/2016 08:55 AM, Alan DeKok wrote:
On Jun 7, 2016, at 11:52 AM, Mike Ely <me@mikeely.org> wrote:
Intriguing. Are you aware of a way in "unlang" to pull all of a user's group memberships and present those in the reply to the NAS? It would certainly be easier to maintain compared to calling an external script. In v3.0.x, you might as well use a shell script. We have to stick with 3.0.x for now. I'm _this_ close here. I wrote a module that follows the pattern in the ntlm_auth module, and call it in post-auth. I can see it run successfully:
Program returned code (0) and output 'domain users,techs' (0) getadgroups : Program executed successfully (0) [getadgroups] = ok The part I am conceptually lost on is how to get that program output - in the case of my test user 'domain users,techs' - into the main post-auth process so I can use "update reply" with whatever custom dictionary we settle on here. How do I set a variable to the ouptut of this module? I've tried somevariable = "%{exec:/path/to/script etc etc}" in the module and then radius says [getadgroups] = noop
On 06/07/2016 11:29 AM, Mike Ely wrote:
On 06/07/2016 08:55 AM, Alan DeKok wrote:
On Jun 7, 2016, at 11:52 AM, Mike Ely <me@mikeely.org> wrote:
Intriguing. Are you aware of a way in "unlang" to pull all of a user's group memberships and present those in the reply to the NAS? It would certainly be easier to maintain compared to calling an external script. In v3.0.x, you might as well use a shell script. We have to stick with 3.0.x for now. I'm _this_ close here. I wrote a module that follows the pattern in the ntlm_auth module, and call it in post-auth. I can see it run successfully:
Program returned code (0) and output 'domain users,techs' (0) getadgroups : Program executed successfully (0) [getadgroups] = ok
The part I am conceptually lost on is how to get that program output - in the case of my test user 'domain users,techs' - into the main post-auth process so I can use "update reply" with whatever custom dictionary we settle on here.
How do I set a variable to the ouptut of this module? I've tried somevariable = "%{exec:/path/to/script etc etc}" in the module and then radius says [getadgroups] = noop
Nevermind, figured it out. Here's where backticks are useful, put the following into my post-auth: update reply { Reply-Message := `/usr/local/bin/groupparser %{User-Name}` } Note: am using Reply-Message as a placeholder for now. And it works!
participants (2)
-
Alan DeKok -
Mike Ely