Using REST to Original COA
As we are using REST module to handle AAA, planning to use the same to originate COA as well. While going through the archives, found that Alan suggested, we can use rest module in originate coa virtual server.The issue is how to configure it. Usually for AAA, we define the rest module with connect uri, method (get or post), parameters etc. And these gets triggered when FR sends request to REST server. But in the case of originate coa, as the trigger will come from REST server side, what all REST server need to send and how FR will handle it? And I believe trigger will happen when getting Accounting packet post from FR to REST server, do we need to send COA parameters as reply to the same Accounting request? Read the entire originate coa file multiple times, but still couldn't understand how to resolve this.
On Jul 3, 2021, at 3:21 PM, Mohammad Mahefooz <mahefooz@crashcoding.in> wrote:
As we are using REST module to handle AAA, planning to use the same to originate COA as well. While going through the archives, found that Alan suggested, we can use rest module in originate coa virtual server.The issue is how to configure it. Usually for AAA, we define the rest module with connect uri, method (get or post), parameters etc. And these gets triggered when FR sends request to REST server. But in the case of originate coa, as the trigger will come from REST server side,
FreeRADIUS isn't a REST client.
what all REST server need to send and how FR will handle it?
The REST server needs to send a CoA packet/
And I believe trigger will happen when getting Accounting packet post from FR to REST server, do we need to send COA parameters as reply to the same Accounting request? Read the entire originate coa file multiple times, but still couldn't understand how to resolve this.
If the accounting information is in SQL, see raddb/sites-available/coa-relay If the accounting data isn't in SQL, you'll have to find the data, and manually add the necessary attributes. Alan DeKok.
On Sun, 4 Jul 2021 at 07:28, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 3, 2021, at 3:21 PM, Mohammad Mahefooz <mahefooz@crashcoding.in> wrote:
As we are using REST module to handle AAA, planning to use the same to originate COA as well. While going through the archives, found that Alan suggested, we can use rest module in originate coa virtual server.The issue is how to configure it. Usually for AAA, we define the rest module with connect uri, method (get or post), parameters etc. And these gets triggered when FR sends request to REST server. But in the case of originate coa, as the trigger will come from REST server side,
FreeRADIUS isn't a REST client.
what all REST server need to send and how FR will handle it?
The REST server needs to send a CoA packet/
Or write a small webserver in python using flask to then make the CoA requests. Less than 30 lines of code to do that. Or tinyradius is a great Java library that works too.
And I believe trigger will happen when getting Accounting packet post from FR to REST server, do we need to send COA parameters as reply to the same Accounting request? Read the entire originate coa file multiple times, but still couldn't understand how to resolve this.
If the accounting information is in SQL, see raddb/sites-available/coa-relay
If the accounting data isn't in SQL, you'll have to find the data, and manually add the necessary attributes.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes, we can generate CoA request from REST server, but the question is where to send it. As Alan said, FR isn't a REST client, and CoA is a trigger from REST server side, I believe we can send it when REST server gets Access-Request or Accounting-Request from FR. And further question is that do we need to generate entire CoA request starting from update coa/disconnect {...} or do we need to just send attributes? ---- On Sun, 04 Jul 2021 01:02:02 +0530 peter@crypt.nz wrote ----On Sun, 4 Jul 2021 at 07:28, Alan DeKok <aland@deployingradius.com> wrote:>>> > On Jul 3, 2021, at 3:21 PM, Mohammad Mahefooz <mahefooz@crashcoding.in>> wrote:> >> > As we are using REST module to handle AAA, planning to use the same to> originate COA as well. While going through the archives, found that Alan> suggested, we can use rest module in originate coa virtual server.The issue> is how to configure it. Usually for AAA, we define the rest module with> connect uri, method (get or post), parameters etc. And these gets triggered> when FR sends request to REST server. But in the case of originate coa, as> the trigger will come from REST server side,>> FreeRADIUS isn't a REST client.>> > what all REST server need to send and how FR will handle it?>> The REST server needs to send a CoA packet/>Or write a small webserver in python using flask to then make the CoArequests. Less than 30 lines of code to do that. Or tinyradius is a greatJava library that works too.> > And I believe trigger will happen when getting Accounting packet post> from FR to REST server, do we need to send COA parameters as reply to the> same Accounting request? Read the entire originate coa file multiple times,> but still couldn't understand how to resolve this.>> If the accounting information is in SQL, see> raddb/sites-available/coa-relay>> If the accounting data isn't in SQL, you'll have to find the data, and> manually add the necessary attributes.>> Alan DeKok.>>>> -> List info/subscribe/unsubscribe? See> http://www.freeradius.org/list/users.html-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 3, 2021, at 3:39 PM, Mohammad Mahefooz <mahefooz@crashcoding.in> wrote: Please edit your responses so that the text isn't all put together. It makes it difficult to read your messages,
Yes, we can generate CoA request from REST server, but the question is where to send it.
To FreeRADIUS.
As Alan said, FR isn't a REST client, and CoA is a trigger from REST server side, I believe we can send it when REST server gets Access-Request or Accounting-Request from FR. And further question is that do we need to generate entire CoA request starting from update coa/disconnect {...} or do we need to just send attributes?
Please read raddb/sites-available/coa-relay This is documented. I'm not going to copy that documentation into an email message. Just read the documentation. Alan DeKok.
I've gone through the coa-relay document, as per my understanding it makes easy to originate coa by just specifying few attributes and remaining attributes FR will get from SQL.<br/>My question wasn't about the attributes, it was about two things. One is, when to send CoA packet from REST server, is it as a reply to Access-Request or Accounting-Request request?<br/>Second question is about the format of CoA packet. Do I need to generate entire text starting from "update coa/disconnect {attributes...}" or can I just send all required attributes without the "update coa/disconnect"?
On Jul 4, 2021, at 12:43 AM, Mohammad Mahefooz <mahefooz@crashcoding.in> wrote:
I've gone through the coa-relay document, as per my understanding it makes easy to originate coa by just specifying few attributes and remaining attributes FR will get from SQL.
Mostly, but you still have to send a CoA packet to FreeRADIUS.
My question wasn't about the attributes, it was about two things. One is, when to send CoA packet from REST server, is it as a reply to Access-Request or Accounting-Request request?
The REST server doesn't get Access-Request or Accounting-Request packets. It gets REST queries. So it can't "reply" to Access-Request or Accounting-Request packets that it never sees. Instead, your REST server has to create a new CoA packet, and send it to FreeRADIUS.
Second question is about the format of CoA packet. Do I need to generate entire text starting from "update coa/disconnect {attributes...}" or can I just send all required attributes without the "update coa/disconnect"?
You need to use a RADIUS client to send a CoA packet. This has nothing to do with "update coa". That's only used in the configuration files in FreeRADIUS. Alan DeKok.
Understood, but in one of your response in archives, you mentioned no need to use radius client for coa packet, because originate-coa module will handle. So I'm wondering is this not possible when using REST? Is it must we need to use radius client to generate CoA?
On Jul 4, 2021, at 8:54 AM, Mohammad Mahefooz <mahefooz@crashcoding.in> wrote:
Understood, but in one of your response in archives, you mentioned no need to use radius client for coa packet, because originate-coa module will handle. So I'm wondering is this not possible when using REST? Is it must we need to use radius client to generate CoA?
If your REST server wants to send CoA packets, then it has to be a RADIUS client. If you're unclear on the difference between FreeRADIUS and a REST server, then this list isn't the place to learn about basic networking. Alan DeKok.
Got it, one last question. In this case, we need to configure coa in FR to receive CoA packet from REST server and also configure originate-coa to send the same packet to NAS, is this flow correct?
On Jul 4, 2021, at 9:08 AM, Mohammad Mahefooz <mahefooz@crashcoding.in> wrote:
Got it, one last question. In this case, we need to configure coa in FR to receive CoA packet from REST server and also configure originate-coa to send the same packet to NAS, is this flow correct?
No. I pointed you to the documentation, and to the virtual server which works. I really can't explain it any better than that. Alan DeKok.
participants (3)
-
Alan DeKok -
Mohammad Mahefooz -
Peter Lambrechtsen