Thanks for the pointer. I'm not entirely certain as to the proper place to put such a thing, though. The examples I've been able to pull up show others using 'if' statements and such in the 'authorize' block, after calling preprocess. However, the following attempt: authorize { preprocess if ( Called-Station-ID =~ /4262606/ ) { User-Name := "%{Stripped-User-Name}@myispname.com" } ... } ...gives me an error of "Line is not in 'attribute = value' format" with the line number of the 'if' statement. Am I missing something basic here? Thanks, J Fox Stephen Bowman wrote:

On Wed, Oct 15, 2008 at 3:52 PM, Javier Fox <jfox@corp.spiritone.com <mailto:jfox@corp.spiritone.com>> wrote:

Hi folks,

I have a bit of a conundrum trying to implement FreeRadius for a system where users from multiple ISP names must all authenticate in the same place, and I'm hoping a more experienced user can shed some light.

In a nutshell, I need to do the following: -Check the 'called-station-id' of an incoming RADIUS request -If the id is A, B, or C, set a hint/realm flag to "alpha" -If the id is D, E, or F, set a hint/realm flag to "beta" -If the id is anything else, set a hint/realm flag to "gamma" -Based on the value of the hint/realm flag, rewrite the username before attempting authentication (by adding '@ispname1', '@ispname2', etc.) -Conversely, if the username already looks like 'user@ispname', leave it alone

For completeness' sake, I'm performing the authentication against a Postgres database. In its current state, the system is able to happily authenticate users as long as the username is provided in the format "username@ispname"; otherwise they are rejected.

Our old RADIUS system (using Radiator) appears to call a perl script to perform this username rewriting, but that just seems like a nasty hack that I'd prefer to avoid.

Any advice on this would be immeasurably appreciated.

Thanks, J. Fox

Answer: unlang

http://freeradius.org/radiusd/man/unlang.html

------------------------------------------------------------------------

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I've tried every permutation of the 'if' line I can think of - quotes, no quotes, single-equal, double-equal, equal-tilde - but FreeRadius still doesn't like that 'if' line, and errors out with "Line is not in 'attribute = value' format" on startup. Again, I apologize if I'm missing something blatantly obvious here, but I seem to be following the exact same format as every example on the Internet; it just doesn't like it. Do I need to add some special config line so it knows to watch for (and interpret) the unlang statements? I had initially tried using a switch{} block and it complained that it didn't know what 'switch' meant. Thanks, J. Fox tnt@kalik.net wrote:

if(whatever) { update request { User-Name := ...

Ivan Kalik Kalik Informatika ISP

Dana 15/10/2008, "Javier Fox" <jfox@corp.spiritone.com> piše:

...

Thanks for the pointer. I'm not entirely certain as to the proper place to put such a thing, though. The examples I've been able to pull up show others using 'if' statements and such in the 'authorize' block, after calling preprocess. However, the following attempt:

authorize {

preprocess

if ( Called-Station-ID =~ /4262606/ ) { User-Name := "%{Stripped-User-Name}@myispname.com" }

... }

....gives me an error of "Line is not in 'attribute = value' format" with the line number of the 'if' statement. Am I missing something basic here?

Thanks, J Fox

Stephen Bowman wrote:

...

On Wed, Oct 15, 2008 at 3:52 PM, Javier Fox <jfox@corp.spiritone.com <mailto:jfox@corp.spiritone.com>> wrote:

Hi folks,

I have a bit of a conundrum trying to implement FreeRadius for a system where users from multiple ISP names must all authenticate in the same place, and I'm hoping a more experienced user can shed some light.

In a nutshell, I need to do the following: -Check the 'called-station-id' of an incoming RADIUS request -If the id is A, B, or C, set a hint/realm flag to "alpha" -If the id is D, E, or F, set a hint/realm flag to "beta" -If the id is anything else, set a hint/realm flag to "gamma" -Based on the value of the hint/realm flag, rewrite the username before attempting authentication (by adding '@ispname1', '@ispname2', etc.) -Conversely, if the username already looks like 'user@ispname', leave it alone

For completeness' sake, I'm performing the authentication against a Postgres database. In its current state, the system is able to happily authenticate users as long as the username is provided in the format "username@ispname"; otherwise they are rejected.

Our old RADIUS system (using Radiator) appears to call a perl script to perform this username rewriting, but that just seems like a nasty hack that I'd prefer to avoid.

Any advice on this would be immeasurably appreciated.

Thanks, J. Fox

Answer: unlang

http://freeradius.org/radiusd/man/unlang.html

------------------------------------------------------------------------

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Ah, that might be the problem then. The Boss wants to stick with the official Debian packages, which for Etch are stuck back at 1.1.3. If there's any way for this to work with the currently installed version, I'd prefer to take that path, but if not, I'll look into upgrading. Thanks again, J. Fox Stephen Bowman wrote:

2008/10/15 Javier Fox <jfox@corp.spiritone.com <mailto:jfox@corp.spiritone.com>>

I've tried every permutation of the 'if' line I can think of - quotes, no quotes, single-equal, double-equal, equal-tilde - but FreeRadius still doesn't like that 'if' line, and errors out with "Line is not in 'attribute = value' format" on startup.

Again, I apologize if I'm missing something blatantly obvious here, but I seem to be following the exact same format as every example on the Internet; it just doesn't like it. Do I need to add some special config line so it knows to watch for (and interpret) the unlang statements? I had initially tried using a switch{} block and it complained that it didn't know what 'switch' meant.

Thanks, J. Fox

tnt@kalik.net <mailto:tnt@kalik.net> wrote:

if(whatever) { update request { User-Name := ...

Ivan Kalik Kalik Informatika ISP

Umm, oops, forgot to ask and just noticed you didn't say in your initial message. What version of FR are you using (radiusd -v)?

If you aren't in 2.x, get there. Preferably 2.1.1. <http://2.1.1.>

------------------------------------------------------------------------

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Ah, thank you so much. I'll give this a shot in the morning and hopefully it will do what we need it to do. Thanks again, J Fox tnt@kalik.net wrote:

It's hints file for you then:

http://wiki.freeradius.org/Adding%2C_Removing%2C_Modifying_Attributes_for_fu...

You should be able to modify second example for your needs.

Ivan Kalik Kalik Informatika ISP

Dana 15/10/2008, "Javier Fox" <jfox@corp.spiritone.com> piše:

...

Ah, that might be the problem then. The Boss wants to stick with the official Debian packages, which for Etch are stuck back at 1.1.3.

If there's any way for this to work with the currently installed version, I'd prefer to take that path, but if not, I'll look into upgrading.

Thanks again, J. Fox

Stephen Bowman wrote:

...

2008/10/15 Javier Fox <jfox@corp.spiritone.com <mailto:jfox@corp.spiritone.com>>

I've tried every permutation of the 'if' line I can think of - quotes, no quotes, single-equal, double-equal, equal-tilde - but FreeRadius still doesn't like that 'if' line, and errors out with "Line is not in 'attribute = value' format" on startup.

Again, I apologize if I'm missing something blatantly obvious here, but I seem to be following the exact same format as every example on the Internet; it just doesn't like it. Do I need to add some special config line so it knows to watch for (and interpret) the unlang statements? I had initially tried using a switch{} block and it complained that it didn't know what 'switch' meant.

Thanks, J. Fox

tnt@kalik.net <mailto:tnt@kalik.net> wrote:

if(whatever) { update request { User-Name := ...

Ivan Kalik Kalik Informatika ISP

Umm, oops, forgot to ask and just noticed you didn't say in your initial message. What version of FR are you using (radiusd -v)?

If you aren't in 2.x, get there. Preferably 2.1.1. <http://2.1.1.>

------------------------------------------------------------------------

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I've tried every permutation of the 'if' line I can think of - quotes, no quotes, single-equal, double-equal, equal-tilde - but FreeRadius still doesn't like that 'if' line, and errors out with "Line is not in 'attribute = value' format" on startup.

if ( Called-Station-ID =~ /4262606/ ) { update request { User-Name := "%{User-Name}@myispname.com" # <== not Stripped } } That should work. Ivan Kalik Kalik Informatika ISP