. . .

man unlang. Read about variables.

Ivan Kalik

O.K. That gets us to the per packet instances of the Cisco-AVPair. We can access the array of two or five instances of Cisco-AVPair that are in the respective packets. That gets us to the strings that are defined. Once you have the string from the array "variable=value" is there a means built into freeradius to write the value of the variable name (both contained in the string) to an attribute? Bryan Campbell

One of the attributes we are after is the client-mac-address from Cisco-AVPair = "client-mac-address=0012.3fb2.15d2". So far it is now converted to an attribute of its own client-mac-address=0012.3fb2.15d2. (by setting cisco-av-hack to yes and adding some attributes to the dictionary) Now to get it to be the callingstationid. Looks like that will require that attr_rewrite be used to redefine callingstationid to be the mac address defined as client-mac-address. Still reading a bit on how to get that done. Anyone have any suggestions? If so, please send them along. Bryan Bob Franklin wrote:

On Mon, 7 Dec 2009, Bryan Campbell wrote:

...

O.K. That gets us to the per packet instances of the Cisco-AVPair. We can access the array of two or five instances of Cisco-AVPair that are in the respective packets. That gets us to the strings that are defined.

How about using a regexp:

if ("%{Cisco-AVPair}" =~ /^ssid=(.+)$/) { update request { UCam-Essid-Name := "%{1}" } }

I haven't been able to test this with more than one Cisco-AVPair attribute; I wasn't sure what the conclusion was about that, but I think it should match.

[You need to define your equivalent of UCam-Essid-Name in the dictionary.]

- Bob

O.K. What is the best way to accomplish the following . . . For a specific NAS-IP-Address=10.10.10.10 Accounting packet includes the following . . . %{Calling-Station-Id}(does not exist) %{client-mac-address}=0000.0000.0000 Need to write the value for . . . %{client-mac-address} into %{Calling-Station-Id} . . . so that the Calling-Station-Id will be written to the MySQL database radacct table. Bryan - Michael Bowe wrote:

...

One of the attributes we are after is the client-mac-address from Cisco-AVPair = "client-mac-address=0012.3fb2.15d2".

So far it is now converted to an attribute of its own client-mac-address=0012.3fb2.15d2. (by setting cisco-av-hack to yes and adding some attributes to the dictionary)

Now to get it to be the callingstationid. Looks like that will require that attr_rewrite be used to redefine callingstationid to be the mac address defined as client-mac-address.

Still reading a bit on how to get that done. Anyone have any suggestions? If so, please send them along.

Hi,

Tweak the freeradius conf with_cisco_vsa_hack = yes

Add dictionary entry something like this : ATTRIBUTE client-mac-address 3004 string

Give the dialup.conf a bit of a tweak, so if calling-station-id isn't available, try putting the client-mac-address instead : Change '%{Calling-Station-Id}' To '%{Calling-Station-Id:-%{client-mac-address}}'

Michael.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi, I am authenticating users on cisco switches (telnet or console access) amongst others. In sites-enabled/default, after pap, I have: if(!control:Auth-Type && (request:NAS-Port-Type == Virtual || request:NAS-Port-Type == Async) && ldap_staff-Ldap-Group == correctADgroup) { update control { Auth-Type = "ntlm_auth" } update reply { cisco-avpair = shell:priv-lvl=15 } } If I enter "user@realm" rather than just "user" then the request is proxied to the servers for the default realm. What is the best way to prevent proxying for just these users whilst allowing it for all others? A pointer to the relevant docs would be much appreciated. Thanks in advance, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

something like Proxy-To-Realm := LOCAL

This is documentented in a comment just before the "realm LOCAL" definition in the default proxy.conf.

Thanks for the guidance. If anyone is interested the construct below seems to work a treat. Leighton if((request:NAS-Port-Type == Virtual || request:NAS-Port-Type == Async)&& ..more conditions to define the NAS...){ update control { Proxy-To-Realm := LOCAL } if(ldap_staff-Ldap-Group == correctADgroup){ update control { Auth-Type := "ntlm_auth" } update reply { cisco-avpair = shell:priv-lvl=15 } } } --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.