RLM_Rest and Dynamic Clients
FreeRADIUS version: 3.0.9 I was curious if there was a way to include dynamic-clients via the rest api module in FreeRADIUS. I currently have it setup using LDAP, but we’re looking to use a dedicated server cluster to manage our NAS’s and I’m having a hard time wrapping my head around a way of configuring such an implementation. Any links or previous threads would be extremely helpful. Thanks!
On Jul 16, 2015, at 1:29 PM, Nick Cappelletti <nick@switchtower.com> wrote:
I was curious if there was a way to include dynamic-clients via the rest api module in FreeRADIUS.
Read raddb/sites-available/dynamic-clients Then, use the rest module in that virtual server. Have the rest module return the attributes needed to define a client. The server doesn't care where it gets those attributes from. So long as they exist, it can create a dynamic client. Alan DeKok.
Alan, Thanks for the response. I’ve read over the dynamic clients a few times, and understand how reading from a file, reading from a DB, and how the LDAP integration works, but I’m still trying to grasp the concept of the REST integration and how to keep the number of requests down to a minimum. With the LDAP and SQL integration, I know that to grab the FreeRADIUS-Client-Shortname and FreeRADIUS-Client-Secret that we need for our clients, they’re all separate queries and with the number of devices we have on our network (2000+), and the large number of logins we have, I’m afraid I would end up DOS’ing the web server the API sits on with said requests. The other questions I have is: how to configure the rest module. I’ve seen the demo perl server, found a server fault pages explaining how to get ‘authorize’ to work (http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freer... <http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freeradius>), and read through the comments in the source, and I could make an educated guess on how to configure the dynamic-clients, but without knowing for sure, I’d be grasping at straws trying to get it to work. The best that I could come up with was: server dynamic_clients { authorize { if ("%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Shortname = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'&return=shortname}" &FreeRADIUS-Client-Secret = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}&return=secret" } } ok } } Sorry for the ignorance, I try not to post to mailings lists unless I truly can’t find the information I need. —Nick
On Jul 16, 2015, at 1:41 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 16, 2015, at 1:29 PM, Nick Cappelletti <nick@switchtower.com> wrote:
I was curious if there was a way to include dynamic-clients via the rest api module in FreeRADIUS.
Read raddb/sites-available/dynamic-clients
Then, use the rest module in that virtual server. Have the rest module return the attributes needed to define a client.
The server doesn't care where it gets those attributes from. So long as they exist, it can create a dynamic client.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 17, 2015, at 8:08 AM, Nick Cappelletti <nick@switchtower.com> wrote:
Thanks for the response. I’ve read over the dynamic clients a few times, and understand how reading from a file, reading from a DB, and how the LDAP integration works, but I’m still trying to grasp the concept of the REST integration and how to keep the number of requests down to a minimum. With the LDAP and SQL integration, I know that to grab the FreeRADIUS-Client-Shortname and FreeRADIUS-Client-Secret that we need for our clients, they’re all separate queries and with the number of devices we have on our network (2000+), and the large number of logins we have, I’m afraid I would end up DOS’ing the web server the API sits on with said requests.
The dynamic clients are cached for a period of time. This is documented. So the rest API will get hit for *one* packet, and then never again for 5-10 minutes, or whatever you set the timeout as. You're free to set the timeout for an hour. In which case the API will get hit about every 2 seconds on average.
The other questions I have is: how to configure the rest module. I’ve seen the demo perl server, found a server fault pages explaining how to get ‘authorize’ to work (http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freer... <http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freeradius>), and read through the comments in the source, and I could make an educated guess on how to configure the dynamic-clients, but without knowing for sure, I’d be grasping at straws trying to get it to work.
I don't understand what the issue is... there is *nothing* magic about dynamic clients. Just make sure that you set the right attributes with the right values. Where those values come from is a separate step.
The best that I could come up with was:
server dynamic_clients { authorize { if ("%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Shortname = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'&return=shortname}" &FreeRADIUS-Client-Secret = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}&return=secret"
That should probably work. One thing we've done in the 3.1 branch is to add a "map" capability. The rest module can return a set of values at once, and they can get mapped to a set of RADIUS attributes. That lowers the number of API calls. But for your case, loading a dynamic client every 2 seconds shouldn't be a problem. If that's a problem, you can set the timeout to 10 hours. And then use "radmin" to manually delete the client if you need to do that. Alan DeKok.
Alan, Thanks again, perhaps I’m over thinking the simplicity of the dynamic clients. I’d like to utilize the 3.1 branch’s map function, so I’ll be upgrading and will try to figure that out. Thanks for the information and work on FreeRADIUS! :)
On Jul 17, 2015, at 8:31 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 17, 2015, at 8:08 AM, Nick Cappelletti <nick@switchtower.com> wrote:
Thanks for the response. I’ve read over the dynamic clients a few times, and understand how reading from a file, reading from a DB, and how the LDAP integration works, but I’m still trying to grasp the concept of the REST integration and how to keep the number of requests down to a minimum. With the LDAP and SQL integration, I know that to grab the FreeRADIUS-Client-Shortname and FreeRADIUS-Client-Secret that we need for our clients, they’re all separate queries and with the number of devices we have on our network (2000+), and the large number of logins we have, I’m afraid I would end up DOS’ing the web server the API sits on with said requests.
The dynamic clients are cached for a period of time. This is documented. So the rest API will get hit for *one* packet, and then never again for 5-10 minutes, or whatever you set the timeout as.
You're free to set the timeout for an hour. In which case the API will get hit about every 2 seconds on average.
The other questions I have is: how to configure the rest module. I’ve seen the demo perl server, found a server fault pages explaining how to get ‘authorize’ to work (http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freer... <http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freeradius>), and read through the comments in the source, and I could make an educated guess on how to configure the dynamic-clients, but without knowing for sure, I’d be grasping at straws trying to get it to work.
I don't understand what the issue is... there is *nothing* magic about dynamic clients. Just make sure that you set the right attributes with the right values. Where those values come from is a separate step.
The best that I could come up with was:
server dynamic_clients { authorize { if ("%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Shortname = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'&return=shortname}" &FreeRADIUS-Client-Secret = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}&return=secret"
That should probably work.
One thing we've done in the 3.1 branch is to add a "map" capability. The rest module can return a set of values at once, and they can get mapped to a set of RADIUS attributes. That lowers the number of API calls.
But for your case, loading a dynamic client every 2 seconds shouldn't be a problem. If that's a problem, you can set the timeout to 10 hours. And then use "radmin" to manually delete the client if you need to do that.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan, I know you’re a busy man, and given the number of question and answers you provide, have better things to do then answer the silly questions I have, but if you could briefly explain how the ‘mapping’ works in the dynamic clients, given a single REST call to a server, I would be immensely in your debt. :) Thanks again, and any information, links, or comments are much appreciated. —Nick
On Jul 17, 2015, at 8:51 AM, Nick Cappelletti <nick@switchtower.com> wrote:
Alan,
Thanks again, perhaps I’m over thinking the simplicity of the dynamic clients. I’d like to utilize the 3.1 branch’s map function, so I’ll be upgrading and will try to figure that out.
Thanks for the information and work on FreeRADIUS! :)
On Jul 17, 2015, at 8:31 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 17, 2015, at 8:08 AM, Nick Cappelletti <nick@switchtower.com> wrote:
Thanks for the response. I’ve read over the dynamic clients a few times, and understand how reading from a file, reading from a DB, and how the LDAP integration works, but I’m still trying to grasp the concept of the REST integration and how to keep the number of requests down to a minimum. With the LDAP and SQL integration, I know that to grab the FreeRADIUS-Client-Shortname and FreeRADIUS-Client-Secret that we need for our clients, they’re all separate queries and with the number of devices we have on our network (2000+), and the large number of logins we have, I’m afraid I would end up DOS’ing the web server the API sits on with said requests.
The dynamic clients are cached for a period of time. This is documented. So the rest API will get hit for *one* packet, and then never again for 5-10 minutes, or whatever you set the timeout as.
You're free to set the timeout for an hour. In which case the API will get hit about every 2 seconds on average.
The other questions I have is: how to configure the rest module. I’ve seen the demo perl server, found a server fault pages explaining how to get ‘authorize’ to work (http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freer... <http://serverfault.com/questions/597393/configuring-rlm-rest-module-in-freeradius>), and read through the comments in the source, and I could make an educated guess on how to configure the dynamic-clients, but without knowing for sure, I’d be grasping at straws trying to get it to work.
I don't understand what the issue is... there is *nothing* magic about dynamic clients. Just make sure that you set the right attributes with the right values. Where those values come from is a separate step.
The best that I could come up with was:
server dynamic_clients { authorize { if ("%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Shortname = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'&return=shortname}" &FreeRADIUS-Client-Secret = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}&return=secret"
That should probably work.
One thing we've done in the 3.1 branch is to add a "map" capability. The rest module can return a set of values at once, and they can get mapped to a set of RADIUS attributes. That lowers the number of API calls.
But for your case, loading a dynamic client every 2 seconds shouldn't be a problem. If that's a problem, you can set the timeout to 10 hours. And then use "radmin" to manually delete the client if you need to do that.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 20, 2015, at 3:03 PM, Nick Cappelletti <nick@switchtower.com> wrote:
I know you’re a busy man, and given the number of question and answers you provide, have better things to do then answer the silly questions I have, but if you could briefly explain how the ‘mapping’ works in the dynamic clients, given a single REST call to a server, I would be immensely in your debt. :)
I'd ask Arran... he's done the REST stuff. The code in v3.1.x isn't done, and as a result isn't completely documented yet. Alan DeKok.
Aaron, Just getting your attention, so I apologize for using your email directly. Curious if you could provide me any links, examples, or documentation on using a ‘map’ for variable in the dynamic-clients section of FreeRADIUS? The plan is to use the REST module, but use a single API call that returns the needed JSON and then assign all the required variables, for FreeRADIUS, from said JSON. Thanks! —Nick
On Jul 20, 2015, at 9:33 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 20, 2015, at 3:03 PM, Nick Cappelletti <nick@switchtower.com> wrote:
I know you’re a busy man, and given the number of question and answers you provide, have better things to do then answer the silly questions I have, but if you could briefly explain how the ‘mapping’ works in the dynamic clients, given a single REST call to a server, I would be immensely in your debt. :)
I'd ask Arran... he's done the REST stuff.
The code in v3.1.x isn't done, and as a result isn't completely documented yet.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 20, 2015, at 9:54 AM, Nick Cappelletti <nick@switchtower.com> wrote:
Aaron,
Just getting your attention,
Helps if you use my name :) My island has beer and whiskey, way better.
so I apologize for using your email directly. Curious if you could provide me any links, examples, or documentation on using a ‘map’ for variable in the dynamic-clients section of FreeRADIUS?
Nope. Not written yet, and it'll be in v3.1.x. It's slated for development very soon.
The plan is to use the REST module, but use a single API call that returns the needed JSON and then assign all the required variables, for FreeRADIUS, from said JSON.
In the interim, just format your responses correctly and you can achieve the same effect. http://doc.freeradius.org/rest_8c.html#af244341316c3780799377980000104e9 -Arran "I don't often write documentation, but when I do, I hide it in function doxygen headers so the users will never find it"
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Nick Cappelletti