Group Authorization Question
I have authentication working from my cisco ASA550 VPN appliance to a FreeRadius 2.1.1 server, using NTLM_AUTH for backend authentication. That all works. Now I need to add authorization into the mix. 1. On the Radius server, I want to add a group X with a list of authorized usernames. 2. On the VPN side, the user selects a profile, and logs in, but I only want members of group X to be able to connect to that profile, even if the authentication is correct. I have no idea how to make the connection between the group profile I select on the VPN side, with the group X on the radius side. I'm not even sure how (or where) to create such a group with freeRadius. Can anyone point me in the right direction? -Mike
Post the debug of the request. Is that profile appearing in some request attribute? Ivan Kalik Kalik Informatika ISP Dana 31/12/2008, "Mike Diggins" <mike.diggins@mcmaster.ca> piše:
I have authentication working from my cisco ASA550 VPN appliance to a FreeRadius 2.1.1 server, using NTLM_AUTH for backend authentication. That all works. Now I need to add authorization into the mix.
1. On the Radius server, I want to add a group X with a list of authorized usernames. 2. On the VPN side, the user selects a profile, and logs in, but I only want members of group X to be able to connect to that profile, even if the authentication is correct.
I have no idea how to make the connection between the group profile I select on the VPN side, with the group X on the radius side. I'm not even sure how (or where) to create such a group with freeRadius. Can anyone point me in the right direction?
-Mike - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, 31 Dec 2008, tnt@kalik.net wrote:
Post the debug of the request. Is that profile appearing in some request attribute?
I made a little progress since my last email. I discovered how to return a group name in the Reply-Message attribute, and then parse that on my appliance. I'm wondering though, if I have users with multiple group membership, should I create a string of group names such as "group1,group2, group3" for each user, and return that as the Reply-Message? Is that a sensible way to do it, or is there a better way? -Mike
Dana 31/12/2008, "Mike Diggins" <mike.diggins@mcmaster.ca> pi�e:
I have authentication working from my cisco ASA550 VPN appliance to a FreeRadius 2.1.1 server, using NTLM_AUTH for backend authentication. That all works. Now I need to add authorization into the mix.
1. On the Radius server, I want to add a group X with a list of authorized usernames. 2. On the VPN side, the user selects a profile, and logs in, but I only want members of group X to be able to connect to that profile, even if the authentication is correct.
I have no idea how to make the connection between the group profile I select on the VPN side, with the group X on the radius side. I'm not even sure how (or where) to create such a group with freeRadius. Can anyone point me in the right direction?
-Mike -
I made a little progress since my last email. I discovered how to return a group name in the Reply-Message attribute, and then parse that on my appliance. I'm wondering though, if I have users with multiple group membership, should I create a string of group names such as "group1,group2, group3" for each user, and return that as the Reply-Message? Is that a sensible way to do it, or is there a better way?
You can also return multiple attributes (with different values) using += operator. Ivan Kalik Kalik Informatika ISP
On Thu, 1 Jan 2009, tnt@kalik.net wrote:
I made a little progress since my last email. I discovered how to return a group name in the Reply-Message attribute, and then parse that on my appliance. I'm wondering though, if I have users with multiple group membership, should I create a string of group names such as "group1,group2, group3" for each user, and return that as the Reply-Message? Is that a sensible way to do it, or is there a better way?
You can also return multiple attributes (with different values) using += operator.
Thanks. I'll try that as well. On a related note, should the rlm_dbm_parse program be able to convert the users file (assuming it is the correct syntax) directly? It complains about the ntlm_auth type. [root@dradius1 rlm_dbm]# ./rlm_dbm_parser -c -i users -o userdb /usr/local/src/freeradius-server-2.1.1/src/modules/rlm_dbm/.libs/lt-rlm_dbm_parser: users[50]: syntax error Error: Unknown value ntlm_auth for attribute Auth-Type Record loaded: 0 Lines parsed: 50 Record skiped: 0 Warnings: 0 Errors: 1 My users file contains: [root@dradius1 rlm_dbm]# cat users | grep -v "^#" diggins Auth-Type := ntlm_auth Reply-Message = "Group=Staff", Reply-Message += "Group=Network" DEFAULT Auth-Type := ntlm_auth DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP -Mike
Mike Diggins wrote:
On a related note, should the rlm_dbm_parse program be able to convert the users file (assuming it is the correct syntax) directly? It complains about the ntlm_auth type.
I wouldn't suggest using rlm_dbm. It's not really maintained, and it's not necessary. As of 2.x, the server puts the "users" file entries into a hash when it loads the file. I've tested 100K users being loaded in a second or two on a reasonable machine. On top of that, 2.x supports HUP better than 1.x. So... rlm_dbm is almost never necessary any more. If you have less than 10K entries in the "users" file, I would suggest that rlm_dbm is not for you. If you have more than 10K users, I would suggest using an SQL database. Alan DeKok.
Hi Mike, Are you trying to have the radius server send an access-reject when the user is not in the group? Or are you trying to send a list of groups to the VPN device? - Alok On Jan 1, 2009, at 3:21 PM, Alan DeKok wrote:
Mike Diggins wrote:
On a related note, should the rlm_dbm_parse program be able to convert the users file (assuming it is the correct syntax) directly? It complains about the ntlm_auth type.
I wouldn't suggest using rlm_dbm. It's not really maintained, and it's not necessary.
As of 2.x, the server puts the "users" file entries into a hash when it loads the file. I've tested 100K users being loaded in a second or two on a reasonable machine. On top of that, 2.x supports HUP better than 1.x.
So... rlm_dbm is almost never necessary any more.
If you have less than 10K entries in the "users" file, I would suggest that rlm_dbm is not for you. If you have more than 10K users, I would suggest using an SQL database.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, 2 Jan 2009, Alok Vimawala wrote:
Hi Mike,
Are you trying to have the radius server send an access-reject when the user is not in the group? Or are you trying to send a list of groups to the VPN device?
I couldn't figure out how to have the client (in this case a cisco ASA5500 VPN) send the group profile id or name along with the request, so I ended up doing it the other way, where the Radius server sends back a list of authorized groups, and my appliance makes the decision on authorization. I don't know if that's the best way or not. -Mike
On Jan 1, 2009, at 3:21 PM, Alan DeKok wrote:
Mike Diggins wrote:
On a related note, should the rlm_dbm_parse program be able to convert the users file (assuming it is the correct syntax) directly? It complains about the ntlm_auth type.
I wouldn't suggest using rlm_dbm. It's not really maintained, and it's not necessary.
As of 2.x, the server puts the "users" file entries into a hash when it loads the file. I've tested 100K users being loaded in a second or two on a reasonable machine. On top of that, 2.x supports HUP better than 1.x.
So... rlm_dbm is almost never necessary any more.
If you have less than 10K entries in the "users" file, I would suggest that rlm_dbm is not for you. If you have more than 10K users, I would suggest using an SQL database.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-Mike
participants (4)
-
Alan DeKok -
Alok Vimawala -
Mike Diggins -
tnt＠kalik.net