Using user groups to simply my config
Hello, How I can go about assigning a group value to each user definition and then post-auth (I think from reading) use that group name to define the specific attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id. I simply want to do this to avoid having to repeat all these tunnel values for each device. I am running freeradius v3.0.25 on freebsd. Pseudo Example authorize file AABBCCDDEEFFGG Group := "iot", Cleartext-Password := "AABBCCDDEEFFGG" site-enabled/default (I think it might go here) if (group == "iot) { #update reply, set Tunnel-* values } Any guidance someone could provide would be great. All the examples I have found seem to be using the mysql backend and I don't have a need for the additional complexity but will go down that route if its required.
On Apr 15, 2022, at 12:00 AM, Jason Womack via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
How I can go about assigning a group value to each user definition and then post-auth (I think from reading) use that group name to define the specific attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id. I simply want to do this to avoid having to repeat all these tunnel values for each device. I am running freeradius v3.0.25 on freebsd.
See mods-available/etc_group You can change the filename to something else (e.g. raddb/group), and then list the module in the "authorize" section. Alan DeKok.
See mods-available/etc_group I reviewed this module and it just don't think it was what I was trying to do since I wasn't trying to use my system group file.
Here is what I have working if someone could provide a general sanity check. dictionary ATTRIBUTE VLAN-Group-Name 3000 string authorize file #I created a bunch of just test users for using radtest AA-BB-CC-DD-EE-FF Cleartext-Password := "AA-BB-CC-DD-EE-FF", VLAN-Group-Name := "kids" A1-BB-CC-DD-EE-FF Cleartext-Password := "A1-BB-CC-DD-EE-FF", VLAN-Group-Name := "general" A2-BB-CC-DD-EE-FF Cleartext-Password := "A2-BB-CC-DD-EE-FF", VLAN-Group-Name := "iot" in site configuration under post-auth switch "%{control:VLAN-Group-Name}" { case "iot" { update reply { Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = XXX } } case "kids" { update reply { Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = XXX } } case "general" { update reply { Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = XXX } } } This seems to accomplish the configuration I want to achieve using the config files. Any issues with this approach?
On Apr 15, 2022, at 12:41 PM, Jason Womack via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Here is what I have working if someone could provide a general sanity check.
dictionary ATTRIBUTE VLAN-Group-Name 3000 string
That's fine.
authorize file #I created a bunch of just test users for using radtest AA-BB-CC-DD-EE-FF Cleartext-Password := "AA-BB-CC-DD-EE-FF", VLAN-Group-Name := "kids" A1-BB-CC-DD-EE-FF Cleartext-Password := "A1-BB-CC-DD-EE-FF", VLAN-Group-Name := "general" A2-BB-CC-DD-EE-FF Cleartext-Password := "A2-BB-CC-DD-EE-FF", VLAN-Group-Name := "iot"
That works.
in site configuration under post-auth ... This seems to accomplish the configuration I want to achieve using the config files. Any issues with this approach?
Nope. If it works, ship it! Alan DeKok.
participants (2)
-
Alan DeKok -
Jason Womack