Thanks for answer Alan El mar, 22 ago 2023 a las 22:44, Alan DeKok (<aland@deployingradius.com>) escribió:

On Aug 22, 2023, at 9:29 PM, Carlos Botejara <cbotejara@gmail.com> wrote:

...

I need to configure 2 realms, and validate users depending on the realm from which they connect, I need specific rules for each site (with different sql queries). The users are in a mysql database. I configured the Realms in the proxy.conf file as follows (because I

don't

...

have domain) realm1 { nostrip } realm2 { nostrip }

That's a good start.

...

The realm is configured in the Mikrotik router of each site. The Realm attribute for Mikrotik is Mikrotik-Realm

That doesn't matter much.

The approach here is always the same. Write down what you want to do. Look at the debug log to see what the NAS is sending, etc.

In this, case:

* what are the different queries you want to run? Way to validate the user, in one realm I will receive username/password, while in the other only user (a mac address)

* How different are they? Not much. One of the sites will authenticate by username and password, while the other will do so only by mac. Mikrotik runs a DHCP service, and it will validate against freeradius (macs are already loaded in the database), only in this case, Mikrotik sends only the MAC as user and does not send password.

* do the different queries need different tables, different other things ??? No, I use the same tables.

* what are the different rules?

they send bandwidth, vlan, IP address.

It's hard to answer a question of "I need to do stuff. How do I configure it?" When you give more information we get about what you need, you get better answers. When the questions are vague, the answers are vague too. Yes, that's true, sorry, you're right. The recommended approach is to use different SQL tables based on realms. This means that you can use the standard queries. You then just need to update the mods-available/sql.conf file, to use the correct table name. Where that file says:

authcheck_table = "radcheck"

You can change that to:

authcheck_table = "%{%{Realm}_radcheck:-radcheck}"

i.e. "if the realm exists, use a radcheck table named for the realm, otherwise use the normal radcheck table".

Do this for all of the tables named in mods-available/sql.

The server will automatically get the Realm, and use it in the SQL query. All you need to do is to create a series of tables for each realm. Your main FreeRADIUS configuration can then be very, very, simple. How does Freeradius interpret the Realm if Mikrotik sends it as Mikrotik-Realm? Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thanks!

On Aug 24, 2023, at 3:12 PM, Carlos Botejara <cbotejara@gmail.com> wrote:

Is there any other way to do it?

To do *what*? You are very careful to say as little as possible about what you have, and what you want todo. If you tried to do things and they didn't work, try to do different things.

I can't create 2 tables with different Realm names. Should at least be able to take an action by reading the MIKROTIK-REALM attribute and be able to execute the corresponding authorize_check_query.

The queries can be edited. I suggest reading the comments which describe how the queries work. Alan DeKok.

On Aug 24, 2023, at 5:28 PM, Carlos Botejara <cbotejara@gmail.com> wrote:

I have two scenarios, and I need to authorize users and devices separately. In the first case, I have remote users that need to access a specific network. In the second case, I have remote devices installed in the field and I need to access another network.

You can write a bunch of if / then / else statements to implement any logic you want. The usual recommendation is to write down exactly what you have, and what you want the server to do. Be as specific as possible. Just use normal language. When all that's done, translate it to "unlang". It will generally be fairly simple.

Now, I need to send specific configurations to both scenarios, depending on the Realm on where the connection comes from, like vlan-id, bandwidth, quota, etc.

if (realm a) { ... stuff for realm a ... } if (realm b) { ... stuff for realm b ... } You can put anything inside of the "if" block. You can have two different SQL modules, which look at different tables, or even different databases.

For example, for scenario1 (users), the authentication is through pppoe, and the Mikrotik sends User and Password, and works fine.

Attach a log.

(9) Mikrotik-Rate-Limit = "3584K/7168K" (9) Acct-Input-Octets = 2513739245

That's an accounting packet. It's not an authentication packet. You can't apply VLAN assignment to accounting packet. I would suggest paying attention to what's going on, and how the server works. If you're trying to write rules for Access-Request packets, then there is absolutely no reason to post an example accounting packet to the list. Attention to detail is critical here. If you're randomly trying things, you will never get anything done. If you don't look at what you're doing, you will also never get anything done.

For scenario2, the devices need to be authenticated through mac address, via DHCP server.

What does that mean? DHCP servers don't authenticate MAC addresses. If you just put random words together, they don't make sense. You have to describe (and understand) exactly what happens. WHEN the user connects, THEN it does DHCP to the mikrotik. THEN the mikrotik sends an Access-Request packet to the RADIUS server. The Access-Request packet contains the MAC in attribute X, and also some other attributes, A, B, C, etc.

The DHCP Server sends to Radius the mac address device as username but doesn't send a password.

So? And... is that packet a secret? Did you pay attention to any documentation which said "POST THE DEBUG OUTPUT" ? We also don't need to see an accounting packet which has no MAC address or anything else interesting in it. I don't understand why you would ask about Access-Request packets and MAC addresses... and then post an Accounting-Request packet with no MAC. None of that makes sense. It's just wasting everyones time.

I hope I have been clear now, and I hope you can help me. If you need more information, please let me know.

How about posting information about the problem you have? I.e. the full debug log of an Access-Request. Not part of a random Accounting-Request packet. I don't understand why this has to be so difficult. I can't read your mind. I don't have access to your systems. I only know what you post to the list. Yet over and over, you don't post anything useful, or you post irrelevant information. Do you want this problem solved? Then describe what you're doing. Accurately. If this doesn't happen, I'm just going to give up. Alan DeKok.