FR 2.1.6 add realm to User-Name before Proxy by listening port
Hello. How would i go about configuring the following with FreeRadius 2.1.6? I need to change the User-Name attribute by adding a realm to it based on incoming listening port, before the Access-Request is proxied (Proxy-To-Realm) to backend server. Googled and found a way to do this with the hints file and one listening port, but i need to do this for many ports. We are talking about 100-200 ports. One port per customer/realm. User-Name "david" from Customer 1 connects: AAA client (groupname auth) -> FR, Port 21812 (FR converts username to david@customer1) -> Access-Request to Backend OTP-server with "User-Name = david@customer1" User-Name "david" from Customer 2 connects: AAA client (groupname auth) -> FR, Port 21813 (FR converts username to david@customer2) -> Access-Request to Backend OTP-server with "User-Name = david@customer2" This is what i would like FR to do. Is virtual servers the best way? I have not used that before, so i am thankful for any configuration examples you can give me. The AAA client (NAS-IP-Address) is _usually_ the same for all customers. My hints-file: DEFAULT User-Name !~ ".*@", NAS-IP-Address == "x.x.x.x" User-Name := "%{User-Name}@customer1" Thanks in advance. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 13/12/10 13:48, Mika wrote:
Hello. How would i go about configuring the following with FreeRadius 2.1.6? I need to change the User-Name attribute by adding a realm to it based on incoming listening port, before the Access-Request is proxied (Proxy-To-Realm) to backend server.
Easy, use unlang (see "man unlang"): authorize { ... if (Packet-Dst-Port == xxx) { update request { User-Name := "%{User-Name}@therealm" } update control { Proxy-To-Realm := PROXYREALM } } ... } Alternatively you could look the realm up in a database: authorize { .. update request { Tmp-String-0 = "%{sql:select ... where port='%{Packet-Dst-Port}' User-Name := "%{User-Name}@%{Tmp-String-0}" } update control { Proxy-To-Realm := "%{Tmp-String-0}" } ... } There are many variations on this.
Hello. Thank you Phil for the quick answer and these examples. Exactly what i was looking for. I will give this a go. Seems easy enough. Do you know where i could find some or all the possible values that I can use for this tweaking? Like: Packet-Dst-Port and so on.. I guess all of the RADIUS-Attributes could be used that are allowed in the Access-Request packet? Thanks again. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 14/12/10 12:25, Mika wrote:
Hello. Thank you Phil for the quick answer and these examples. Exactly what i was looking for. I will give this a go. Seems easy enough. Do you know where i could find some or all the possible values that I can use for this tweaking? Like: Packet-Dst-Port
doc/variables.rst ...contains some info.
and so on.. I guess all of the RADIUS-Attributes could be used that are allowed in the Access-Request packet?
Yes. Some attributes are internal/virtual or added by FreeRadius when the packet is received, or by the "preprocess" module.
Hello. I am having some problems with the below configuration that does not work. I have configured a virtual server on port 21000 that is to receive Access-Request packets, the server is to look for a realm in a mssql database before another query is done for the authentication server to proxy to. I do not want to put my sql queries to dialup.conf, instead i would like the below logic to work. But i am missing something vital and probably obvious. Regards Mika virtual-server config in sites-enabled/ listen { ipaddr = 192.168.199.5 port = 21000 type=auth virtual_server = SERVER-21000 } server SERVER-21000 { authorize { preprocess pap sql update request { realm = "%{sql:select AccountIDSuffix FROM RequestGroup where AUTProxyPort = 21000}" User-Name := "%{User-Name}@%{realm}" NAS-IP-Address := "%{Client-IP-Address}" } update control { Tmp-String-0 = "%{sql:select AUTServer FROM RequestGroup where AUTProxyPort = 21000}" Proxy-To-Realm := "%{Tmp-String-0}" } } } ------- from radiusd -X Listening on authentication address 192.168.199.5 port 21000 as server SERVER-21000 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.199.9 port 46599, id=117, length=60 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 server SERVER-21000 { # Executing section authorize from file /etc/raddb/sites-enabled/all-servers +- entering group authorize {...} ++[preprocess] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 4 [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail } # server SERVER-21000 Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hello. Both uppercase and lowercase seem to work fine with isql command-line, so i think my odbc and freetds config is ok.. see below. I am wondering if there is something wrong with the way i am trying to use variablenames? If i change the variable "realm" to something else the server does not even start? I am using 2.1.10 btw. [root@aut-proxy mssql]# isql AUT-DB dbuser dbpassword +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select AccountIDSuffix from RequestGroup where AUTProxyPort = 21000 +----------------------------------------------------------------------------+ | AccountIDSuffix | +----------------------------------------------------------------------------+ | test | +----------------------------------------------------------------------------+ SQLRowCount returns 1 1 rows fetched SQL> SQL> SELECT AccountIDSuffix FROM RequestGroup WHERE AUTProxyPort = 21000 +----------------------------------------------------------------------------+ | AccountIDSuffix | +----------------------------------------------------------------------------+ | test | +----------------------------------------------------------------------------+ SQLRowCount returns 1 1 rows fetched -------------------------- Changed variablename from realm to proxytorealm update request { proxytorealm = "%{sql:SELECT AccountIDSuffix FROM RequestGroup WHERE AUTProxyPort = 21000}" User-Name := "%{User-Name}@%{proxytorealm}" ------------------------- rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to sa_otp@AUT-DB:1433/VPNOTP rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (sql): Connected new DB handle, #4 /etc/raddb/sites-enabled/all-servers[35]: ERROR: Invalid vendor name in attribute name "proxytorealm" /etc/raddb/sites-enabled/all-servers[30]: Errors parsing authorize section. [root@aut-proxy mssql]# -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hello. Seems that the variables (Tmp-String-0) do not work at all. Even without sql. See the below configuration. Does anyone have a clue what i am missing? [root@aut-proxy sites-available]# more all-servers listen { ipaddr = 192.168.199.5 port = 21000 type=auth virtual_server = SERVER-21000 } server SERVER-21000 { authorize { preprocess pap update request { Tmp-String-0 = "testrealm" User-Name := "%{User-Name}@%{Tmp-String-0}" } update control { Proxy-To-Realm := "AUT-OTP02" } } } -------------- radiusd -X Listening on authentication address 192.168.199.5 port 21000 as server SERVER-21000 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.199.9 port 34238, id=107, length=60 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 server SERVER-21000 { # Executing section authorize from file /etc/raddb/sites-enabled/all-servers +- entering group authorize {...} ++[preprocess] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop expand: %{User-Name}@%{Tmp-String-0} -> testuser@ ++[request] returns noop ++[control] returns noop } # server SERVER-21000 WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 152 to x.x.x.x port 1812 User-Name = "testuser@" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Proxy-State = 0x313037 Proxying request 0 to home server x.x.x.x port 1812 Going to the next request -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
That explains why the variables did not work. Thanks Alan. I still can´t get my sql queries working though with the below config. Do i need to use the queries/definitions in dialup.conf? Does the User-Name need to exist in the SQL database to be able to add a realm to it? I would like the server to find the realm in the database and just Proxy the access-request. listen { ipaddr = 192.168.199.5 port = 21000 type=auth virtual_server = SERVER-21000 } server SERVER-21000 { authorize { preprocess pap sql update request { Tmp-String-0 = "%{sql:select AccountIDSuffix FROM RequestGroup where AUTProxyPort = 21000}" } update request { User-Name := "%{User-Name}@%{Tmp-String-0}" } update control { Proxy-To-Realm := "AUT-OTP02" } } } debug: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 192.168.199.5 port 21000 as server SERVER-21000 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.199.9 port 55578, id=50, length=60 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 server SERVER-21000 { # Executing section authorize from file /etc/raddb/sites-enabled/all-servers +- entering group authorize {...} ++[preprocess] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: -> [sql] Error generating query; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail } # server SERVER-21000 Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 50 to 192.168.199.9 port 55578 -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Mika wrote:
Do i need to use the queries/definitions in dialup.conf?
No.
Does the User-Name need to exist in the SQL database to be able to add a realm to it?
No.
server SERVER-21000 { authorize { preprocess pap sql
Why is "sql" here? You can probably just delete that line, and it will work.
[sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: -> [sql] Error generating query; rejecting user
You deleted the default SQL queries. Don't do that. Alan DeKok.
Hello. Removed sql from the authorize section and got the below error (unknown module sql..). What else could i have missed? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 192.168.199.5 port 21000 as server SERVER-21000 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.199.9 port 56379, id=234, length=60 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 server SERVER-21000 { # Executing section authorize from file /etc/raddb/sites-enabled/all-servers +- entering group authorize {...} ++[preprocess] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop WARNING: Unknown module "sql" in string expansion "%" ++[request] returns noop expand: %{User-Name}@%{Tmp-String-0} -> testuser@ ++[request] returns noop ++[control] returns noop } # server SERVER-21000 WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 247 to 164.9.250.252 port 1812 User-Name = "testuser@" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Proxy-State = 0x323334 Proxying request 0 to home server 164.9.250.252 port 1812 -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
Hello. Removed sql from the authorize section and got the below error (unknown module sql..). What else could i have missed?
you're calling SQL somwehere in your authorize config - check all your config files for anything mentioning sql. since you arent running that module then anything trying to call it will fail alan
Yes! Finally.. Thanks Alan & Alan. I missed the obvious conf files... instantiate section in radiusd.conf didn´t contain sql. Thanks again to this great FreeRadius list! /M -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-befo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (4)
-
Alan Buxey -
Alan DeKok -
Mika -
Phil Mayers