Hi, I have configured EAP-TTLS+PAP using sites-enabled/proxy-inner-tunnel. After I get the Access-Accept message, I do dynamic VLAN assignment in sites-enabled/default in the post-auth section. The one thing is: the dynamic VLAN assignment uses the outer User-Name. It works if the outer-tunnel matches the inner-tunnel username. I want to do the dynamic VLAN assignment using the Inner-Tunnel User-Name. Where can I access the inner-tunnel %{request.User-Name} with ulang after the Access-Accept message ? Regards, Christoph
On May 5, 2025, at 10:32 AM, Christoph Egger via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I have configured EAP-TTLS+PAP using sites-enabled/proxy-inner-tunnel. After I get the Access-Accept message, I do dynamic VLAN assignment in sites-enabled/default in the post-auth section.
OK, that's good.
The one thing is: the dynamic VLAN assignment uses the outer User-Name. It works if the outer-tunnel matches the inner-tunnel username. I want to do the dynamic VLAN assignment using the Inner-Tunnel User-Name.
Where can I access the inner-tunnel %{request.User-Name} with ulang after the Access-Accept message ?
You update the inner-tunnel virtual server, and copy the User-Name to the outer request. Perhaps in the "control" list, so that it doesn't affect anything else: update outer.control { &User-Name := &User-Name } Then in the default virtual server, you access &control:User-Name. The underlying issue is that the inner request is finished (and gone) after it returns an Access-Accept. So you can't access it, because it's gone. You have to manually save any information that you need. Alan DeKok.
Am 05.05.25 um 17:03 schrieb Alan DeKok:
On May 5, 2025, at 10:32 AM, Christoph Egger via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I have configured EAP-TTLS+PAP using sites-enabled/proxy-inner-tunnel. After I get the Access-Accept message, I do dynamic VLAN assignment in sites-enabled/default in the post-auth section.
OK, that's good.
The one thing is: the dynamic VLAN assignment uses the outer User-Name. It works if the outer-tunnel matches the inner-tunnel username. I want to do the dynamic VLAN assignment using the Inner-Tunnel User-Name.
Where can I access the inner-tunnel %{request.User-Name} with ulang after the Access-Accept message ?
You update the inner-tunnel virtual server, and copy the User-Name to the outer request. Perhaps in the "control" list, so that it doesn't affect anything else:
update outer.control { &User-Name := &User-Name }
Thanks. In the output of freeradius -X I see in the inner-tunnel authorize the inner-tunnel Username is assigned to the outer-tunnel.
Then in the default virtual server, you access &control:User-Name.
There I still get the original outer-tunnel Username. Is it reset somewhere between inner-tunnel authorize and default post-auth ?
The underlying issue is that the inner request is finished (and gone) after it returns an Access-Accept. So you can't access it, because it's gone. You have to manually save any information that you need.
Ah, I was unaware of that. I spent hours trying to do the impossible... Thank you for pointing this out. Christoph
On May 6, 2025, at 1:20 AM, Christoph Egger via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Thanks. In the output of freeradius -X I see in the inner-tunnel authorize the inner-tunnel Username is assigned to the outer-tunnel.
That's good.
Then in the default virtual server, you access &control:User-Name.
There I still get the original outer-tunnel Username. Is it reset somewhere between inner-tunnel authorize and default post-auth ?
Are you looking in the *control* list? As always, post the debug output. Alan DeKok.
Am 06.05.25 um 12:33 schrieb Alan DeKok:
On May 6, 2025, at 1:20 AM, Christoph Egger via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Thanks. In the output of freeradius -X I see in the inner-tunnel authorize the inner-tunnel Username is assigned to the outer-tunnel.
That's good.
Then in the default virtual server, you access &control:User-Name.
There I still get the original outer-tunnel Username. Is it reset somewhere between inner-tunnel authorize and default post-auth ?
Are you looking in the *control* list?
That is how I do the VLAN assignment in default post-auth: if (LDAP-Group == "MyGroup") { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "%{%{ldap:ldap:///ou=groups,dc=ldap,dc=example,dc=com?Tunnel-Private-Group-Id?one?(&(cn=MyGroup)(member=*%{User-Name}*))}:-20}" } } It works when outer-tunnel username matches the inner tunnel username.
Then in the default virtual server, you access &control:User-Name.
On your advice I changed %{User-Name} to %{&control:User-Name}: if (LDAP-Group == "MyGroup") { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "%{%{ldap:ldap:///ou=groups,dc=ldap,dc=example,dc=com?Tunnel-Private-Group-Id?one?(&(cn=MyGroup)(member=*%{&control:User-Name}*))}:-20}" } }
As always, post the debug output.
EXPAND (&(objectClass=posixAccount)(cn=%{User-Name})) --> (&(objectClass=posixAccount)(cn=thatsme)) Performing search in "ou=users,dc=ldap,dc=example,dc=com" with filter "(&(objectClass=posixAccount)(cn=thatsme))", scope "sub" Waiting for search result... Search returned no results Oh, freeradius did not reload the default file on restart ... Is there some caching? "thatsme" is the outer-tunnel Username which does not exist in the LDAP-Database. Regards, Christoph
Am 07.05.25 um 10:23 schrieb Christoph Egger via Freeradius-Users:
EXPAND (&(objectClass=posixAccount)(cn=%{User-Name})) --> (&(objectClass=posixAccount)(cn=thatsme)) Performing search in "ou=users,dc=ldap,dc=example,dc=com" with filter "(&(objectClass=posixAccount)(cn=thatsme))", scope "sub" Waiting for search result... Search returned no results
I found the issue: I also have to use &control:User-Name in the ldap Module in the user- and group-settings. Now it works. Thanks for your help. Christoph
participants (2)
-
Alan DeKok -
Christoph Egger