Is FreeRADIUS 2.1.1 capable of handling NAI decorations
Hi, I've been working and (also a little bit deploying) with FreeRADIUS 2.1.1 for a while and everything has been smooth enough. Today for the first time I step into a problem with the handling of NAI sent by the client through the NAS. The problem consists in the prensence of a WiMAX decoration inside the NAI. As stated by WiMAX Forum 1.2 Stage 3 a NAI can be composed by a Username, a realm and an optional part known as WiMAX decoration. To be more precise a valid NAI, according to WF is the following: {attribute=11}username@realm FreeRADIUS 2.1.1 seems to be unable to process the NAI decoration so the username is passed unaltered to the modules and of course there're a lot of problems arising for the presence of the curly braces and the equal sing inside the User-Name. If I hack the safe character list of Oracle (the database I chose to store user credentials and profiles) adding both the curly braces and the equal sign everything work fine but IMHO is not the solution. I tried also to use the attr_rewrite module trying to remove the unwanted prefix from the User-Name attrribute but this obviously breaks EAP (as Alan also has stated in a mail discussion I red on the Internet). Sorry if I've been too prolix, at the end my question is the one of the subject..."Is FreeRADIUS 2.1.1 capable of handling NAI decorations according to WiMaX Forum 1.2 St. 3?" And if not, can I have some suggestion on which one can be the starting point for the development of such functionality? Thank you for the cooperation, Luca Adamo LaRT - University of Florence
Luca Adamo wrote:
FreeRADIUS 2.1.1 seems to be unable to process the NAI decoration
What does that mean? The configuration language ("man unlang") has support for a wide range of attribute matching && re-writing methods. The *default* methods shipped in the example configuration files do not include WiMAX examples. Instead, they show the traditional RADIUS methods of handling realms.
so the username is passed unaltered to the modules and of course there're a lot of problems arising for the presence of the curly braces and the equal sing inside the User-Name.
See "man unlang". You can re-write the User-Name to be anything you want.
If I hack the safe character list of Oracle (the database I chose to store user credentials and profiles) adding both the curly braces and the equal sign everything work fine but IMHO is not the solution. I tried also to use the attr_rewrite module trying to remove the unwanted prefix from the User-Name attrribute but this obviously breaks EAP (as Alan also has stated in a mail discussion I red on the Internet).
That's a larger issue that I'm currently trying to resolve with the IETF, the WiMAX forum, the FMCA, the WBA, and many other acronym-laden groups.
Sorry if I've been too prolix, at the end my question is the one of the subject..."Is FreeRADIUS 2.1.1 capable of handling NAI decorations according to WiMaX Forum 1.2 St. 3?" And if not, can I have some suggestion on which one can be the starting point for the development of such functionality?
Re-writing the User-Name may cause the EAP module to get upset. The simplest way to fix this is to edit src/modules/rlm_eap/*.c in order to remove the checks that require EAP identity to be the same as the User-Name. Alan DeKok.
participants (2)
-
Alan DeKok -
Luca Adamo