I've having a problem getting the proper attributes set on my response packets when using a proxy. If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance, -David Mitchell -- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
I should probably add that I can get the Service-Type added using the 'attrs' file in the post-proxy section. But I want to set the Service-Type based on the user and huntgroup so that users have either Administrative-User or Login-User access depending on the user and device. This doesn't seem to be possible in the attrs file. -David David Mitchell wrote:
I've having a problem getting the proper attributes set on my response packets when using a proxy.
If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance,
-David Mitchell
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
Update reply with unlang: http://freeradius.org/radiusd/man/unlang.html Ivan Kalik Kalik Informatika ISP Dana 26/6/2008, "David Mitchell" <mitchell@ucar.edu> piše:
I should probably add that I can get the Service-Type added using the 'attrs' file in the post-proxy section. But I want to set the Service-Type based on the user and huntgroup so that users have either Administrative-User or Login-User access depending on the user and device. This doesn't seem to be possible in the attrs file.
-David
David Mitchell wrote:
I've having a problem getting the proper attributes set on my response packets when using a proxy.
If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance,
-David Mitchell
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | ----------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ivan Kalik wrote:
Update reply with unlang:
Sure, but where? In the 'attrs' file? I tried adding something there and it complains: DEFAULT Service-Type := %{proxy-request:Service-Type}, # Service-Type == Framed-User, # Service-Type == Login-User, Login-Service == Telnet, results in /home/mitchell/fr/etc/raddb/attrs[104]: Parse error (reply) for entry DEFAULT: Expected end of line or comma Errors reading /home/mitchell/fr/etc/raddb/attrs Is attrs not using unlang? If not, what should I be using instead? It does look like unlang gives me what I want, but it's not clear where I can use it. -David
Ivan Kalik Kalik Informatika ISP
Dana 26/6/2008, "David Mitchell" <mitchell@ucar.edu> piše:
I should probably add that I can get the Service-Type added using the 'attrs' file in the post-proxy section. But I want to set the Service-Type based on the user and huntgroup so that users have either Administrative-User or Login-User access depending on the user and device. This doesn't seem to be possible in the attrs file.
-David
David Mitchell wrote:
I've having a problem getting the proper attributes set on my response packets when using a proxy.
If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance,
-David Mitchell
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | ----------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
David Mitchell wrote:
Ivan Kalik wrote:
Update reply with unlang:
Sure, but where? In the 'attrs' file? I tried adding something there and it complains:
DEFAULT Service-Type := %{proxy-request:Service-Type}, # Service-Type == Framed-User, # Service-Type == Login-User, Login-Service == Telnet,
results in /home/mitchell/fr/etc/raddb/attrs[104]: Parse error (reply) for entry DEFAULT: Expected end of line or comma Errors reading /home/mitchell/fr/etc/raddb/attrs
Is attrs not using unlang? If not, what should I be using instead? It does look like unlang gives me what I want, but it's not clear where I can use it.
So I'm closer. I can update things in post-auth using for example: update reply { Service-Type := "%{control:Service-Type}" Reply-Message := "Go Away %{request:User-Name}" } But I can't get %{Service-Type} to expand. I have no idea what happened to the value I set earlier in the users file. It almost seems like I should not be using the users file at all and trying to implement my authz in post-auth using unlang? That doesn't really seem right though. -David
-David
Ivan Kalik Kalik Informatika ISP
Dana 26/6/2008, "David Mitchell" <mitchell@ucar.edu> piše:
I should probably add that I can get the Service-Type added using the 'attrs' file in the post-proxy section. But I want to set the Service-Type based on the user and huntgroup so that users have either Administrative-User or Login-User access depending on the user and device. This doesn't seem to be possible in the attrs file.
-David
David Mitchell wrote:
I've having a problem getting the proper attributes set on my response packets when using a proxy.
If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance,
-David Mitchell
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | ----------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
Service-Type is in the request. Ivan Kalik Kalik Informatika ISP Dana 26/6/2008, "David Mitchell" <mitchell@ucar.edu> piše:
David Mitchell wrote:
Ivan Kalik wrote:
Update reply with unlang:
Sure, but where? In the 'attrs' file? I tried adding something there and it complains:
DEFAULT Service-Type := %{proxy-request:Service-Type}, # Service-Type == Framed-User, # Service-Type == Login-User, Login-Service == Telnet,
results in /home/mitchell/fr/etc/raddb/attrs[104]: Parse error (reply) for entry DEFAULT: Expected end of line or comma Errors reading /home/mitchell/fr/etc/raddb/attrs
Is attrs not using unlang? If not, what should I be using instead? It does look like unlang gives me what I want, but it's not clear where I can use it.
So I'm closer. I can update things in post-auth using for example: update reply { Service-Type := "%{control:Service-Type}" Reply-Message := "Go Away %{request:User-Name}" }
But I can't get %{Service-Type} to expand. I have no idea what happened to the value I set earlier in the users file. It almost seems like I should not be using the users file at all and trying to implement my authz in post-auth using unlang? That doesn't really seem right though.
-David
-David
Ivan Kalik Kalik Informatika ISP
Dana 26/6/2008, "David Mitchell" <mitchell@ucar.edu> piše:
I should probably add that I can get the Service-Type added using the 'attrs' file in the post-proxy section. But I want to set the Service-Type based on the user and huntgroup so that users have either Administrative-User or Login-User access depending on the user and device. This doesn't seem to be possible in the attrs file.
-David
David Mitchell wrote:
I've having a problem getting the proper attributes set on my response packets when using a proxy.
If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only",
Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance,
-David Mitchell
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | ----------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | ----------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
OK, I think I have this figured out. Does this seem like a reasonable solution? From sites-enabled/default: pre-proxy { # Save our relevant attributes in the 'control' list before # we send our request to the proxy. We will retrieve them later. update control { Service-Type := "%{reply:Service-Type}" Reply-Message := "%{reply:Reply-Message}" } } post-auth { update reply { Service-Type := "%{control:Service-Type}" Reply-Message := "%{control:Reply-Message}" } } Ivan Kalik wrote:
Sure, but where?
Read the first sentence of man unlang. Same place you are calling attrs from.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
OK, I think I have this figured out. Does this seem like a reasonable solution? From sites-enabled/default:
pre-proxy { # Save our relevant attributes in the 'control' list before # we send our request to the proxy. We will retrieve them later. update control { Service-Type := "%{reply:Service-Type}" Reply-Message := "%{reply:Reply-Message}" } }
post-auth { update reply { Service-Type := "%{control:Service-Type}" Reply-Message := "%{control:Reply-Message}" } }
I don't think that you need pre-proxy entries. Service -Type should be in the request list, so you can update reply from there. And Reply-Message can probably be derived from the Service-Type? Ivan Kalik Kalik Informatika ISP
Ivan Kalik wrote:
OK, I think I have this figured out. Does this seem like a reasonable solution? From sites-enabled/default:
pre-proxy { # Save our relevant attributes in the 'control' list before # we send our request to the proxy. We will retrieve them later. update control { Service-Type := "%{reply:Service-Type}" Reply-Message := "%{reply:Reply-Message}" } }
post-auth { update reply { Service-Type := "%{control:Service-Type}" Reply-Message := "%{control:Reply-Message}" } }
I don't think that you need pre-proxy entries. Service -Type should be in the request list, so you can update reply from there. And Reply-Message can probably be derived from the Service-Type?
I set those two attributes in the users file based on the group the username is in and the huntgroup the NAS is in. I tried to find somewhere I could grab the attributes from, but I couldn't find them anywhere. My guess is that the users file set them in the reply packet, but they got overwritten by the response from the proxy? From what I can tell, when I get the response from the proxy nothing is left in the reply packet except proxy-state. Is that normal, or possibly a bug? -David
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
I set those two attributes in the users file based on the group the username is in and the huntgroup the NAS is in.
rlm_perl post_proxy function might be more suited for this.
I tried to find somewhere I could grab the attributes from, but I couldn't find them anywhere. My guess is that the users file set them in the reply packet, but they got overwritten by the response from the proxy? From what I can tell, when I get the response from the proxy nothing is left in the reply packet except proxy-state. Is that normal, or possibly a bug?
That is normal. Reply attributes are not proxied. Ivan Kalik Kalik Informatika ISP
participants (2)
-
David Mitchell -
Ivan Kalik