Hi List, i am still stuck in the problem on how to overwrite replies from freeradius to a nas depending on realms (see http://marc.theaimsgroup.com/?l=freeradius-users&m=116824114228037&w=2 and http://marc.theaimsgroup.com/?l=freeradius-users&m=116903668505574&w=2) and trying different things to solve this (i got no repsonses so far which, of course, is not a complaint! maybe i am asking the wrong or a too dump question ...) i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf) the section "post-proxy", which contains "attr_filter", is _not_ processed. If i am using a "real" proxy (authhost = anotherradius:1812) "attr_filter" does what i want it to do, it replaces some reply-attributes (for VLAN in my case). Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?) Or does someone know a better solution for my problem? Thanks in advance for any help! Regards markus -- Markus Krause email: krause@biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux@biochem.mpg.de
Hi List (again), i forgot to mention that with setting "authhost = localhost:1812" in proxy.conf the "attr_filter" is processed ... Regards Markus Zitat von Markus Krause <krause@biochem.mpg.de>:
Hi List,
i am still stuck in the problem on how to overwrite replies from freeradius to a nas depending on realms (see http://marc.theaimsgroup.com/?l=freeradius-users&m=116824114228037&w=2 and http://marc.theaimsgroup.com/?l=freeradius-users&m=116903668505574&w=2) and trying different things to solve this (i got no repsonses so far which, of course, is not a complaint! maybe i am asking the wrong or a too dump question ...)
i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf) the section "post-proxy", which contains "attr_filter", is _not_ processed. If i am using a "real" proxy (authhost = anotherradius:1812) "attr_filter" does what i want it to do, it replaces some reply-attributes (for VLAN in my case).
Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?)
Or does someone know a better solution for my problem?
Thanks in advance for any help!
Regards markus
-- Markus Krause email: krause@biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98
---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux@biochem.mpg.de
-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Markus Krause email: krause@biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux@biochem.mpg.de
Markus Krause wrote:
i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf)
That's NOT local proxying. It's a hack for telling the server that the realm exists, and it's authoritative.
the section "post-proxy", which contains "attr_filter", is _not_ processed.
Because the request isn't proxied.
Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?)
It's the intended behavior. Maybe try the postauth section? That's really for handling replies from the current server to the NAS. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi Alan, thanks for your answer! Zitat von Alan DeKok <aland@deployingradius.com>:
Markus Krause wrote:
i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf)
That's NOT local proxying. It's a hack for telling the server that the realm exists, and it's authoritative.
the section "post-proxy", which contains "attr_filter", is _not_ processed.
Because the request isn't proxied.
Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?)
It's the intended behavior. ok, that sounds obvious regarding that thats no proxying, of course :-)
Maybe try the postauth section? That's really for handling replies from the current server to the NAS. hmm, that sounds interesting, but i could not find any information (which i could unterstand) on how to do that. would that mean to write a module of my own? maybe in pearl?
Could you please give a small example on how to replace reply attribute? Thank you very much in advance for your help! With best regards markus
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Markus Krause email: krause@biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux@biochem.mpg.de
Markus Krause wrote:
Maybe try the postauth section? That's really for handling replies from the current server to the NAS. hmm, that sounds interesting, but i could not find any information (which i could unterstand) on how to do that. would that mean to write a module of my own? maybe in pearl?
Could you please give a small example on how to replace reply attribute?
The attr_filter module can do this, perhaps. In the CVS head it can. Or, you can use the Perl module. See the example.pl (I think) file for what to do. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (2)
-
Alan DeKok -
Markus Krause