Modifying authorization replies by a proxy
Hi, when the FreeRADIUS is configured as a proxy is there any way to modify the authorization replies (Access-Accept packets) before sending them to the NAS? I need to add there a few attributes (purchased connection speed etc.). Reply attributes in the 'users' file of the proxy seem to be ignored. For example, with the following record in the 'users' file proxying works well but the Framed-IP-Address attribute seems to be ignored: username Proxy-To-Realm := xxx Framed-IP-Address := "2.2.2.2" rlm_attr_rewrite does not seem to be useful in this case as I need to define the rules on a per-user basis. (FreeRADIUS 1.1.6) Martin
Martin Horcicka wrote:
when the FreeRADIUS is configured as a proxy is there any way to modify the authorization replies (Access-Accept packets) before sending them to the NAS? I need to add there a few attributes (purchased connection speed etc.).
Yes. The post-auth section is executed before the server responds to the NAS. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On 6/14/07, Alan Dekok <aland@deployingradius.com> wrote:
Martin Horcicka wrote:
when the FreeRADIUS is configured as a proxy is there any way to modify the authorization replies (Access-Accept packets) before sending them to the NAS? I need to add there a few attributes (purchased connection speed etc.).
Yes. The post-auth section is executed before the server responds to the NAS.
Well, but is there an existing module which I could use in that section to modify the packets on a per user basis? (E.g. something with a 'users'-style configuration.) Martin
Martin Horcicka wrote:
Well, but is there an existing module which I could use in that section to modify the packets on a per user basis? (E.g. something with a 'users'-style configuration.)
Not really. 2.0.0-pre2 has a new configuration language, which makes this kind of thing infinitely easier to do. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On 6/14/07, Martin Horcicka <martin@horcicka.eu> wrote:
On 6/14/07, Alan Dekok <aland@deployingradius.com> wrote:
Martin Horcicka wrote:
when the FreeRADIUS is configured as a proxy is there any way to modify the authorization replies (Access-Accept packets) before sending them to the NAS? I need to add there a few attributes (purchased connection speed etc.).
Yes. The post-auth section is executed before the server responds to the NAS.
Well, but is there an existing module which I could use in that section to modify the packets on a per user basis? (E.g. something with a 'users'-style configuration.)
I have found a solution - using the exec module in the post-proxy section and adding the attributes by an external script. It is not very nice but seems to work. Martin
participants (2)
-
Alan Dekok -
Martin Horcicka