free radius authentication query not working as expected
Hi, Greetings. Hope you all are doing great! I want to achieve zone migration using Nomadix with free Radius. I have made the desired settings on the Nomadix for zone migration. However when I switch between the SSIDs it does not redirect me to the AAA page. Although I get authenticated on Nomadix but the redirection is not working. I have added the authentication query on free radius as (/etc/raddb/sites-enabled/default):- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}" } if (&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql: update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } I stopped the radius daemon - '/etc/init.d/radiusd stop' and then ran the radius in debug mode - radiusd -X. After enabling the zone migration I tried again switching the SSIDs with no portal page redirection. Now when I see the radius log file - (radius_log_switch.txt attached) both the times while switching SSIDs I got Auth: Login OK response. Then I reviewed the radius debug window (radius_debug_log.txt attached) on line 16 it seems that even the authentication query returns nothing still the update query ran and sets the username to null value. So I believe the condition “if (&Tmp-String-0 != "") { “ in the authentication query is not working as expected. And while switching the authentication query is making the groupname column empty. Please suggest. mysql> select * from radusergroup; +------------------------+----------------+----------+ | username | groupname | priority | +------------------------+----------------+----------+ | 78-9E-D0-31-29-7E | | 1 | +------------------------+----------------+----------+ raduserzone is a custom table :- mysql> select * from raduserzone ; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ | 1 | 100051 | 78-9E-D0-31-29-7E | 99 | 78-9E-D0-31-29-7E | +----+---------+-------------------+---------+-------------------+ I am using custom radius table here to track the guest data, while switching , in the database. Afer switching the SSIDs I did not get any portal page (AAA , authentication URL) but I got authenticated on Nomadix and the only thing that changed on Nomadix is that the Port and Room changed from 93 to 77. Can you please share your thoughts here and guide me if I am going in the right direction? Thanks a lot in advance!! Amardeep Singh
On May 5, 2016, at 11:33 PM, Amardeep Singh <aman.xsaintz@gmail.com> wrote:
I have added the authentication query on free radius as (/etc/raddb/sites-enabled/default):-
if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}"
That should work if the data exists in the database.
I stopped the radius daemon - '/etc/init.d/radiusd stop' and then ran the radius in debug mode - radiusd -X.
That's good.
Now when I see the radius log file - (radius_log_switch.txt attached) both the times while switching SSIDs I got Auth: Login OK response.
Which doesn't help. We don't need to see that log output.
Then I reviewed the radius debug window (radius_debug_log.txt attached) on line 16 it seems that even the authentication query returns nothing still the update query ran and sets the username to null value.
Have you tried running the SQL query by hand? That's why it's being printed out. So you can test it. MySQL returns: rlm_sql_mysql: MYSQL Error: No Fields Which means that something is going wrong with the DB layer. i.e. the SELECT returns no data.
I am using custom radius table here to track the guest data, while switching , in the database.
Fix the table and/or the queries so that they work. Test the queries by hand.
Can you please share your thoughts here and guide me if I am going in the right direction? Thanks a lot in advance!!
If you're customizing SQL, you should be debugging SQL first, and RADIUS second. Alan DeKok.
Hi Alan, Thanks for your reply. My goal here is to switch the user's group dynamically, depending on his location on the network. Unfortunately, what I'm seeing on exit from the conditional is that it returns a noop. Should there be an 'ok' after the sql update command? I'm using the following conditional statement in the main authorize section. if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}" } if (&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql: update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } Please suggest! Thanks, Amardeep
On May 13, 2016, at 5:35 AM, Amardeep Singh <aman.xsaintz@gmail.com> wrote:.
My goal here is to switch the user's group dynamically, depending on his location on the network. Unfortunately, what I'm seeing on exit from the conditional is that it returns a noop. Should there be an 'ok' after the sql update command?
For various reason, no. The only thing that matters here is the debug log. Read it, and fix errors it points out. Alan DeKok.
participants (2)
-
Alan DeKok -
Amardeep Singh