How to force users file parsing when returning proxied reply to add per-user AV-Pairs
Hi, I've configured a freeradius server A (version 1.1.3) to proxy request for a specifix realm XYZ to another radius server B. Then, from the online docs, I understood that when A receives the reply from B it should go through its users file and if it finds a match it should add the specified AV-Pairs, like Service-Type (which is the one I need), to the reply it returns to the client that wants to authenticate a user: http://www.gnu.org/software/radius/manual/html_node/Proxy-Service.html#SEC16 Should it do this automatically or do I need to specify something in the realm definition? Second question: I've specified in the realm definition on radius A to remove the @XYZ suffix (strip) when it passes the request to radius B.. Then, when radius A looks into its own users file to append AV-Pairs to the answer, does it look for the stripped user or the user+realm? Thank you in advance for any help. PS: I know that this version may be old, but I can not easily update it at present time. -- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi@gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------
Gianni Costanzi wrote:
I've configured a freeradius server A (version 1.1.3)
Upgrade.
PS: I know that this version may be old, but I can not easily update it at present time.
Nonsense. If you're asking for support on a free forum, use a version which we *can* support. Version 1.1.3 is SIX YEARS OLD. And don't look at the GNU RADIUS manual to see what FreeRADIUS does. They are COMPLETELY different products. GNU RADIUS was started solely to have a "GNU" labeled RADIUS server. It's no longer actively developed, and no one uses it. Alan DeKok.
Gianni Costanzi wrote:
I've configured a freeradius server A (version 1.1.3)
Upgrade.
We're going to upgrade it in the next few weeks
PS: I know that this version may be old, but I can not easily update it at present time.
Nonsense.
It's not a nonsense if you start working in a production environment where hundreds of routers authenticate through radius and you don't know the product.. Certainly it is nothing impossible, just it takes a certain amount of time.
If you're asking for support on a free forum, use a version which we *can* support. Version 1.1.3 is SIX YEARS OLD.
I've asked since I wanted do some tests now and can't wait to upgrade the freeradius version.
And don't look at the GNU RADIUS manual to see what FreeRADIUS does. They are COMPLETELY different products. GNU RADIUS was started solely to have a "GNU" labeled RADIUS server. It's no longer actively developed, and no one uses it.
Thank you.. BTW can you tell me if in the last freeradius versions when radius A proxies a request to radius B and it receives a response from B, should radius A scan its own users file to append AV-Pairs to the response?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi@gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------
Gianni Costanzi wrote:
We're going to upgrade it in the next few weeks
Good.
It's not a nonsense if you start working in a production environment where hundreds of routers authenticate through radius and you don't know the product.. Certainly it is nothing impossible, just it takes a certain amount of time.
Regular upgrades should be part of network policy. If you leave upgrades for years, then the upgrade process will be complex, error-prone, fragile, and hard to reproduce. You can upgrade in stages. Install the new server, and test it. Make ONE router use it. Then another...
Thank you.. BTW can you tell me if in the last freeradius versions when radius A proxies a request to radius B and it receives a response from B, should radius A scan its own users file to append AV-Pairs to the response?
I have no idea. I don't bother remembering which version had what functionality added. In recent versions of the server, this is easy. The post-proxy section does this. Unlang makes it easy. Alan DeKok.
participants (2)
-
Alan DeKok -
Gianni Costanzi