add field in radcheck table
Hi there Is it possible to add check field in radcheck table? Something look like below,gary.companyA and gary.companyB as user name for authentication. +----+------------+-----------------+-------------------------+----+-------------+ | id | username | secondname |attribute | op | value | +----+------------+-----------------+-------------------------+-------------------+ | 1 | gary | companyA |Cleartext-Password | := | garypass | +----+------------+-----------------+-------------------------+-------------------+ | 2 | gary | companyB |Cleartext-Password | := | garypass | +----+------------+-----------------+-------------------------+-------------------+ Best Regards Gary
2011/10/31 gary <gary.yang@browan.com>:
Hi there Is it possible to add check field in radcheck table?
Short answer: yes Long answer: yes, but you need to have sufficient knowledge about how FR works and how to design SQL queries. If you don't even know where the queries are stored, then I suggest you don't even bother.
Something look like below,gary.companyA and gary.companyB as user name for authentication. +----+------------+-----------------+-------------------------+----+-------------+ | id | username | secondname |attribute | op | value | +----+------------+-----------------+-------------------------+-------------------+ | 1 | gary | companyA |Cleartext-Password | := | garypass | +----+------------+-----------------+-------------------------+-------------------+ | 2 | gary | companyB |Cleartext-Password | := | garypass | +----+------------+-----------------+-------------------------+-------------------+
option 1: just store gary.companyA and gary.companyB in username field. option 2: be more clear in what you want, then maybe others can help you. What's your goal to add the field? Does user send gary.companyA as username, or just gary? How does the server get information about companyA or companyB? username? realm? NAS-IP-Address? -- Fajar
Hi Fajar I think the secondname field may be realm instead of. I am thinking this in case without proxy, using local database it can determine by two field "username+realm" instead one check field username such as "gary@companyA" . User can see his/her name like "gary" only without "@companyA" character. Best Regards Gary ----- Original Message ----- From: "Fajar A. Nugraha" <list@fajar.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, October 31, 2011 11:04 AM Subject: Re: add field in radcheck table
2011/10/31 gary <gary.yang@browan.com>:
Hi there Is it possible to add check field in radcheck table?
Short answer: yes
Long answer: yes, but you need to have sufficient knowledge about how FR works and how to design SQL queries. If you don't even know where the queries are stored, then I suggest you don't even bother.
Something look like below,gary.companyA and gary.companyB as user name for authentication. +----+------------+-----------------+-------------------------+----+-------------+ | id | username | secondname |attribute | op | value | +----+------------+-----------------+-------------------------+-------------------+ | 1 | gary | companyA |Cleartext-Password | := | garypass | +----+------------+-----------------+-------------------------+-------------------+ | 2 | gary | companyB |Cleartext-Password | := | garypass | +----+------------+-----------------+-------------------------+-------------------+
option 1: just store gary.companyA and gary.companyB in username field.
option 2: be more clear in what you want, then maybe others can help you. What's your goal to add the field? Does user send gary.companyA as username, or just gary? How does the server get information about companyA or companyB? username? realm? NAS-IP-Address?
-- Fajar
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Oct 31, 2011 at 5:23 PM, gary <gary.yang@browan.com> wrote:
Hi Fajar I think the secondname field may be realm instead of.
First rule before asking anything: make SURE you know what you want. When you're not even sure, how can others help you?
I am thinking this in case without proxy, using local database it can determine by two field "username+realm" instead one check field username such as "gary@companyA" . User can see his/her name like "gary" only without "@companyA" character.
What do you mean "User can SEE"? The question is simple. What does the user put as username? How do you want to process that username? If the user only inputs "gary", and you don't know how you you can get the realm, then how can FR do what you want? By being psychic? -- Fajar
----- Original Message ----- From: "Fajar A. Nugraha" <list@fajar.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, October 31, 2011 8:34 PM Subject: Re: add field in radcheck table
On Mon, Oct 31, 2011 at 5:23 PM, gary <gary.yang@browan.com> wrote:
Hi Fajar I think the secondname field may be realm instead of.
First rule before asking anything: make SURE you know what you want. When you're not even sure, how can others help you?
I am thinking this in case without proxy, using local database it can determine by two field "username+realm" instead one check field username such as "gary@companyA" . User can see his/her name like "gary" only without "@companyA" character.
What do you mean "User can SEE"?
The question is simple. What does the user put as username? How do you want to process that username?
If the user only inputs "gary", and you don't know how you you can get the realm, then how can FR do what you want? By being psychic?
Sorry for my poor english.
From the login page,user can type his name and select pull-down option for the realm and then send to FR server for authentication. for example, gary@domain1 and gary@domain2 come from different company and both in same database. I can directly input gary@domain1 and gary@domain2 as user name for authentication. but I would like to separate two field for checking. user can see(probably read) user infomation(eg:logout page) only user name instead of gary@domain1 . Furthermore, in case lot of data in radcheck, it can be search,sort...etc according to the realm field to improve server performance.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Nov 1, 2011 at 9:07 AM, gary <gary.yang@browan.com> wrote:
From the login page,user can type his name and select pull-down option for
the realm and then send to FR server for authentication. for example, gary@domain1 and gary@domain2 come from different company and both in same database. I can directly input gary@domain1 and gary@domain2 as user name for authentication. but I would like to separate two field for checking. user can see(probably read) user infomation(eg:logout page) only user name instead of gary@domain1 .
This is a captive portal setup, right? FR doesn't really care what user puts in "drop down box", it only cares what the NAS (e.g. chillispot) sends. And the NAS doesn't really care what the user inputs, it only cares what the captive portal sends it (which may or may not be the same as what the user inputs). For example, in my setup the captive portal adds a realm automatically (user can't put it manually) and pre-process the password that user entered (e.g. using a custom hash). In that setup there's really no need to separate user and realm. Just use the default setup.
Furthermore, in case lot of data in radcheck, it can be search,sort...etc according to the realm field to improve server performance.
I actually think the easiest way is to just add a "realm" field in radcheck as ENUM type, indexed, used only for search/sorting purposes, updated automatically by mysql trigger. That way you don't have to modify anything on FR side. -- Fajar
----- Original Message ----- From: "Fajar A. Nugraha" <list@fajar.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, November 01, 2011 11:02 AM Subject: Re: add field in radcheck table
On Tue, Nov 1, 2011 at 9:07 AM, gary <gary.yang@browan.com> wrote:
From the login page,user can type his name and select pull-down option for
the realm and then send to FR server for authentication. for example, gary@domain1 and gary@domain2 come from different company and both in same database. I can directly input gary@domain1 and gary@domain2 as user name for authentication. but I would like to separate two field for checking. user can see(probably read) user infomation(eg:logout page) only user name instead of gary@domain1 .
This is a captive portal setup, right? FR doesn't really care what user puts in "drop down box", it only cares what the NAS (e.g. chillispot) sends. And the NAS doesn't really care what the user inputs, it only cares what the captive portal sends it (which may or may not be the same as what the user inputs).
Yes, I mean FR server will receive user@domain finally.
For example, in my setup the captive portal adds a realm automatically (user can't put it manually) and pre-process the password that user entered (e.g. using a custom hash).
In that setup there's really no need to separate user and realm. Just use the default setup.
Furthermore, in case lot of data in radcheck, it can be search,sort...etc according to the realm field to improve server performance.
I actually think the easiest way is to just add a "realm" field in radcheck as ENUM type, indexed, used only for search/sorting purposes, updated automatically by mysql trigger. That way you don't have to modify anything on FR side.
Thanks. that means username field in radcheck will be user@domain for user authentication. I will take this as first priority testing. I read freeradius how-to it recommand use only user name as authentication. read as below: "If you're stripping all domain name elements from usernames via realms, remember NOT to include the domain name elements in the usernames you put in the SQL tables - they should get stripped BEFORE the database is checked, so name@domain will NEVER match if you're realm stripping (assuming you follow point 2 above) - you should just have 'name' as a user in the database. Once it's working without, and if you want more complex realm handling, go back to work out not stripping (and keeping name@domain in the db) if you really want to." Anyway, it is appreciate if someone can point direction or share documention how to add a check column in radcheck table I can study.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Nov 1, 2011 at 12:42 PM, gary <gary.yang@browan.com> wrote:
I read freeradius how-to it recommand use only user name as authentication.
No it doesn't.
read as below: "If you're stripping all domain name elements from usernames via realms, remember NOT to include the domain name elements in the usernames you put in the SQL tables
You conveniently ignore the first part: "IF you're stripping all domain name elements from usernames" If you don't strip domain names/realms then you don't have to read the rest.
Anyway, it is appreciate if someone can point direction or share documention how to add a check column in radcheck table I can study.
Just edit the queries, e.g. raddb/sql/mysql/dialup.conf. If you want to customize it, you need to have sufficent sql knowldege (e.g. SELECT, JOIN, etc). -- Fajar
Hi Fajar Thank you very much. BS//Gary ----- Original Message ----- From: "Fajar A. Nugraha" <list@fajar.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, November 01, 2011 2:09 PM Subject: Re: add field in radcheck table
On Tue, Nov 1, 2011 at 12:42 PM, gary <gary.yang@browan.com> wrote:
I read freeradius how-to it recommand use only user name as authentication.
No it doesn't.
read as below: "If you're stripping all domain name elements from usernames via realms, remember NOT to include the domain name elements in the usernames you put in the SQL tables
You conveniently ignore the first part: "IF you're stripping all domain name elements from usernames"
If you don't strip domain names/realms then you don't have to read the rest.
Anyway, it is appreciate if someone can point direction or share documention how to add a check column in radcheck table I can study.
Just edit the queries, e.g. raddb/sql/mysql/dialup.conf. If you want to customize it, you need to have sufficent sql knowldege (e.g. SELECT, JOIN, etc).
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Fajar A. Nugraha -
gary