In latest v3.0.x HEAD the server will now process all attributes in the control list when creating dynamic clients. Attributes that are not consumed filling in the fields of the client, will be added as config items which can be accessed using the "%{client:}" xlat. For example: (0) # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) update control { (0) &FreeRADIUS-Client-IP-Prefix = 127.0.0.0/8 (0) &FreeRADIUS-Client-Require-MA = no (0) &FreeRADIUS-Client-Secret = 'testing123' (0) EXPAND %{Packet-Src-IP-Address} (0) --> 127.0.0.1 (0) &FreeRADIUS-Client-Shortname = "127.0.0.1" (0) &Tmp-String-0 = 'foooooo' (0) } # update control = noop (0) [ok] = ok (0) } # authorize = ok } # server dynamic_clients (0) Converting control list to client fields (0) ipaddr = 127.0.0.0/8 (0) require_message_authenticator = no (0) secret = 'testing123' (0) shortname = '127.0.0.1' (0) Tmp-String-0 = 'foooooo' Adding client 127.0.0.0/8 with shared secret "testing123" (0) EXPAND %{client:Tmp-String-0} (0) --> foooooo (0) Tmp-String-1 := "foooooo" This allows easy caching of any information related to the NAS, such as its capabilities and any information required for policy decisions. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 9 Oct 2014, at 22:17, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
In latest v3.0.x HEAD the server will now process all attributes in the control list when creating dynamic clients.
Attributes that are not consumed filling in the fields of the client, will be added as config items which can be accessed using the "%{client:}" xlat.
Equivalent changes made for rlm_ldap. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 13 Oct 2014, at 10:27, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 9 Oct 2014, at 22:17, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
In latest v3.0.x HEAD the server will now process all attributes in the control list when creating dynamic clients.
Attributes that are not consumed filling in the fields of the client, will be added as config items which can be accessed using the "%{client:}" xlat.
Equivalent changes made for rlm_ldap.
rlm_ldap module now supports nested sections in clients. # # Bulk load clients from the directory # client { # Where to start searching in the tree for clients base_dn = "${..base_dn}" # # Filter to match client objects # filter = '(objectClass=radiusClient)' # Search scope, may be 'base', 'one', 'sub' or 'children' # scope = 'sub' # # Client attribute mappings are in the format: # <client attribute> = <ldap attribute> # # The following attributes are required: # * ipaddr | ipv4addr | ipv6addr - Client IP Address. # * secret - RADIUS shared secret. # # All other attributes usually supported in a client # definition are also supported here. # # Schemas are available in doc/schemas/ldap for openldap and eDirectory # attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' # shortname = 'radiusClientShortname' # nas_type = 'radiusClientType' # virtual_server = 'radiusClientVirtualServer' # require_message_authenticator = 'radiusClientRequireMa' # limit { # max_connections = 'radiusClientMaxConnections' # lifetime = 'radiusClientLifetime' # idle_timeout = 'radiusClientIdleTimeout' # } } } I've not defined the new schema attributes yet, probably tomorrow. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (1)
-
Arran Cudbard-Bell