canceling/redirecting realm in pre-proxy ?
There seems to be some comments about being able to "cancel" a proxy in the pre-proxy section.. # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. What I really want to do is test some variables (unlang) and based on the outcome, I want to actually handle the request locally rather than proxy. Maybe this is obvious, but I am not seeing it ? Thanks, Robert
On 6 Oct 2011, at 20:19, Robert Roll wrote:
There seems to be some comments about being able to "cancel" a proxy in the pre-proxy section..
# When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy.
What I really want to do is test some variables (unlang) and based on the outcome, I want to actually handle the request locally rather than proxy. Maybe this is obvious, but I am not seeing it ?
update control { Proxy-To-Realm := 'local' } Maybe... I'm not sure if it'll work. Why don't you just avoid starting the proxy in the first place... -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Good thought, but it doesn't seem to do the trick, but thanks..
Why don't you just avoid starting the proxy in the first place...
I want to actually proxy to a remote server, but they might send it back for further authentication.. I need to detect and handle that, otherwise there would be a loop... Thanks, Robert ________________________________________ From: freeradius-users-bounces+robert.roll=utah.edu@lists.freeradius.org [freeradius-users-bounces+robert.roll=utah.edu@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell [a.cudbardb@freeradius.org] Sent: Thursday, October 06, 2011 12:58 PM To: FreeRadius users mailing list Subject: Re: canceling/redirecting realm in pre-proxy ? On 6 Oct 2011, at 20:19, Robert Roll wrote:
There seems to be some comments about being able to "cancel" a proxy in the pre-proxy section..
# When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy.
What I really want to do is test some variables (unlang) and based on the outcome, I want to actually handle the request locally rather than proxy. Maybe this is obvious, but I am not seeing it ?
update control { Proxy-To-Realm := 'local' } Why d Maybe... I'm not sure if it'll work. Why don't you just avoid starting the proxy in the first place... -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ ! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, Oct 7, 2011 at 8:28 PM, Robert Roll <Robert.Roll@utah.edu> wrote:
Good thought, but it doesn't seem to do the trick, but thanks..
Really? Where did you put it, in authorize? It should work in pre-proxy
Why don't you just avoid starting the proxy in the first place...
I want to actually proxy to a remote server, but they might send it back for further authentication.. I need to detect and handle that, otherwise there would be a loop...
for complex scenarios it might be easier to use rlm_perl, or even rlm_exec. -- Fajar
Below is my pre-proxy paragraph.. Below that is some output.. It just continues to loop.. It looks like the the test is working.. I don't know if it is meaningful or not, but.. +++[control] returns noop Does this mean it did NOT set the value local in Proxy-To-Realm ? Thanks, Robert pre-proxy { if( "%{Packet-Src-IP-Address}" == '160.36.188.8' ) { update control { Proxy-To-Realm := 'local' } } } # Executing section pre-proxy from file /opt/Radius/freeradius/Configs/BackEnd/etc/raddb/proxy.conf +- entering group pre-proxy {...} ++? if ("%{Packet-Src-IP-Address}" == '160.36.188.8' ) expand: %{Packet-Src-IP-Address} -> 160.36.188.8 ? Evaluating ("%{Packet-Src-IP-Address}" == '160.36.188.8' ) -> TRUE ++? if ("%{Packet-Src-IP-Address}" == '160.36.188.8' ) -> TRUE ++- entering if ("%{Packet-Src-IP-Address}" == '160.36.188.8' ) {...} +++[control] returns noop ++- if ("%{Packet-Src-IP-Address}" == '160.36.188.8' ) returns noop ________________________________________ From: freeradius-users-bounces+robert.roll=utah.edu@lists.freeradius.org [freeradius-users-bounces+robert.roll=utah.edu@lists.freeradius.org] On Behalf Of Fajar A. Nugraha [list@fajar.net] Sent: Friday, October 07, 2011 8:41 AM To: FreeRadius users mailing list Subject: Re: canceling/redirecting realm in pre-proxy ? On Fri, Oct 7, 2011 at 8:28 PM, Robert Roll <Robert.Roll@utah.edu> wrote:
Good thought, but it doesn't seem to do the trick, but thanks..
Really? Where did you put it, in authorize? It should work in pre-proxy
Why don't you just avoid starting the proxy in the first place...
I want to actually proxy to a remote server, but they might send it back for further authentication.. I need to detect and handle that, otherwise there would be a loop...
for complex scenarios it might be easier to use rlm_perl, or even rlm_exec. -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, Oct 7, 2011 at 10:01 PM, Robert Roll <Robert.Roll@utah.edu> wrote:
+++[control] returns noop
Does this mean it did NOT set the value local in Proxy-To-Realm ?
Thanks,
Robert
pre-proxy {
if( "%{Packet-Src-IP-Address}" == '160.36.188.8' ) { update control { Proxy-To-Realm := 'local' } }
}
Sorry, my mistake. It should be in authorize section. I just tested this and it works. -- Fajar
On 7 Oct 2011, at 15:28, Robert Roll wrote:
Good thought, but it doesn't seem to do the trick, but thanks..
Why don't you just avoid starting the proxy in the first place...
I want to actually proxy to a remote server, but they might send it back for further authentication.. I need to detect and handle that, otherwise there would be a loop...
Ditch rlm_realm and use your own condition in authorize. authorize { preprocess split_username_nai if(Stripped-User-Domain != 'my_local_realm' && Huntgroup-Name != 'servers_I_might_proxy_to'){ update control { Proxy-To-Relam := 'my_remote_realm' } } else { # Local processing... } } You can also use %{Proxy-State[#]} to determine whether the request has already been proxied if("%{Proxy-State[#]}"){ # This request was received from a proxy server } -Arran
Thanks,
Robert
________________________________________ From: freeradius-users-bounces+robert.roll=utah.edu@lists.freeradius.org [freeradius-users-bounces+robert.roll=utah.edu@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell [a.cudbardb@freeradius.org] Sent: Thursday, October 06, 2011 12:58 PM To: FreeRadius users mailing list Subject: Re: canceling/redirecting realm in pre-proxy ?
On 6 Oct 2011, at 20:19, Robert Roll wrote:
There seems to be some comments about being able to "cancel" a proxy in the pre-proxy section..
# When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy.
What I really want to do is test some variables (unlang) and based on the outcome, I want to actually handle the request locally rather than proxy. Maybe this is obvious, but I am not seeing it ?
update control { Proxy-To-Realm := 'local' } Why d Maybe... I'm not sure if it'll work. Why don't you just avoid starting the proxy in the first place...
-Arran
Arran Cudbard-Bell a.cudbardb@freeradius.org
Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Arran Cudbard-Bell a.cudbardb@networkradius.com Technical consultant and solutions architect 15 Ave. du Granier, Meylan, France +33 4 69 66 54 50
participants (3)
-
Arran Cudbard-Bell -
Fajar A. Nugraha -
Robert Roll