How do you pass Cleartext-Password from CHAP to another module
Hi, I want to authenticate a CHAP request against my sql database, but then pass the Cleartext-Password to the next module. I've got the CHAP working fine, but can't work out how to pass the password on. Is this possible? I have an exec module like this: exec authz { wait = yes program = "authz -u %{User-Name} -p %{Cleartext-Password}" input_pairs = request output_pairs = reply } Then in my authorize section I have: authorize { chap sql authz } The chap authentication works from the debug I get: Wed Feb 16 01:45:29 2011 : Info: Found Auth-Type = CHAP Wed Feb 16 01:45:29 2011 : Info: +- entering group CHAP {...} Wed Feb 16 01:45:29 2011 : Info: [chap] login attempt by "a" with CHAP password Wed Feb 16 01:45:29 2011 : Info: [chap] Using clear text password "a" for user a authentication. Wed Feb 16 01:45:29 2011 : Info: [chap] chap user a authenticated succesfully Wed Feb 16 01:45:29 2011 : Info: ++[chap] returns ok But when it runs my other module I get: Wed Feb 16 01:45:29 2011 : Info: [authz] expand: %{User-Name} -> a Wed Feb 16 01:45:29 2011 : Info: [authz] expand: %{Cleartext-Password} -> The Cleartext-Password isn't set. Does anyone know what I need to set to make this happen? thanks,
On 02/16/2011 02:07 AM, paul smith wrote:
Hi,
I want to authenticate a CHAP request against my sql database, but then pass the Cleartext-Password to the next module. I've got the CHAP working fine, but can't work out how to pass the password on. Is this possible?
I have an exec module like this: exec authz { wait = yes program = "authz -u %{User-Name} -p %{Cleartext-Password}"
This should be: "authz -u %{User-Name} -p %{config:Cleartext-Password}"
Thanks Phil, Unfortunately that doesn't seem to work. I get the following: Wed Feb 16 10:30:20 2011 : Info: [authz] expand: Cleartext-Password -> Cleartext-Password Wed Feb 16 10:30:20 2011 : Debug: WARNING: No such configuration item Cleartext-Password Cleartext-Password is found though because CHAP works. thanks, On Wed, Feb 16, 2011 at 9:07 AM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 02/16/2011 02:07 AM, paul smith wrote:
Hi,
I want to authenticate a CHAP request against my sql database, but then pass the Cleartext-Password to the next module. I've got the CHAP working fine, but can't work out how to pass the password on. Is this possible?
I have an exec module like this: exec authz { wait = yes program = "authz -u %{User-Name} -p %{Cleartext-Password}"
This should be:
"authz -u %{User-Name} -p %{config:Cleartext-Password}" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 16/02/11 11:08, paul smith wrote:
Thanks Phil,
Unfortunately that doesn't seem to work. I get the following:
Wed Feb 16 10:30:20 2011 : Info: [authz] expand: Cleartext-Password -> Cleartext-Password Wed Feb 16 10:30:20 2011 : Debug: WARNING: No such configuration item Cleartext-Password
Interesting. Could you post a proper debug: radiusd -X | tee log ...and then send the contents of "log"
I think that should read %{control:Cleartext-Password}, not 'config' On Wed, Feb 16, 2011 at 3:48 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 16/02/11 11:08, paul smith wrote:
Thanks Phil,
Unfortunately that doesn't seem to work. I get the following:
Wed Feb 16 10:30:20 2011 : Info: [authz] expand: Cleartext-Password -> Cleartext-Password Wed Feb 16 10:30:20 2011 : Debug: WARNING: No such configuration item Cleartext-Password
Interesting.
Could you post a proper debug:
radiusd -X | tee log
...and then send the contents of "log" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
That works perfectly, many thanks eddie and phil. On Wed, Feb 16, 2011 at 3:00 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 16/02/11 14:22, Eddie Stassen wrote:
I think that should read %{control:Cleartext-Password}, not 'config'
Well spotted... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Eddie Stassen -
paul smith -
Phil Mayers