Oliver Gorwits wrote:

I'd welcome some guidance on configuring FreeRADIUS (any version) to select a onward proxy server(s) based on a RADIUS request attribute, and not the username's realm.

In 2.1.7 and earlier, create a fake realm (e.g. foo.bar.baz), and fill out the normal home servers, pools, etc. Then do: authorize { ... update control { Proxy-To-Realm := "foo.bar.baz" } ... } In 2.1.8, you can skip creating the realm. Just create home servers, pools, and do: update control { Home-Server-Pool := "pool-name" }

The specific situation is that it would be useful to proxy based on the wireless SSID to which a user is authenticating. In our Cisco system, this information comes in via the Called-Station-Id attribute of the request packet.

See "man unlang" for generic instructions on creating policies. authorize { ... if (Called-Station-Id =~ /foo/) { update control { ... } } ... }

We're open to any kind of solution, including setting dummy realms, or using the rlm_perl module, but would appreciate any pointers you have, and details on the processing order within FreeRADIUS to make sure we set things up properly.

(Yes, it's also possible just to configure different RADIUS servers directly on the Cisco system per SSID, but we'd much prefer to have one RADIUS configuration there, and proxy onwards from FreeRADIUS.)

Yup. That's usually the safest solution, too. Alan DeKok.