VLan affect based on ldap attribute freeradius v3
Hello In our eduroam configuration I want to assign a vlan to users based on edupersonPrimaryAffiliation ldap attribute of the user unfortunatly , my affectation doesn't match the attribute apparently , Here's what I did : 1) I did mapped the attribute in mods-available/ldap ldap prod { server = 'ldap.ourdomain.eu' ... update { control:Password-With-Header += 'userPassword' control:NT-Password += 'sambaNtPassword' # reply:Reply-Message := 'radiusReplyMessage' reply:Reply-Message := 'eduPersonPrimaryAffiliation' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # reply:User-Category += 'eduPersonPrimaryAffiliation' * reply:User-Category += 'eduPersonPrimaryAffiliation'* control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' # reply: += 'radiusReplyAttribute' } 2) running radiusd -X I do see the ldap query and attribute returned correclty rlm_ldap (prod): Reserved connection (3) (41) prod: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (41) prod: --> (uid=teststud) ... (41) prod: Processing user attributes (41) prod: control:Password-With-Header += '{CRYPT}secretaoSOObH1' (41) prod: control:NT-Password += secret3735323731 (41) prod: reply:Reply-Message := 'faculty' (41) prod: reply:*User-Category += 'faculty'* rlm_ldap (prod): Released connection (3) (41) [prod] = updated 3) but later from sites-available/default on the post-auth where I check the attribute value in order to affect Vlan to users : post-auth { $INCLUDE ../vlanaffect.conf vlanaffect.conf containing : * if (*( reply:UserCategory == "employee") || (reply:*UserCategory == "faculty"*) || (reply:UserCategory == "staff" ) || (reply:UserCategory == "researcher") || (reply:UserCategory == "member")) { update reply { Tunnel-Private-Group-Id :=*903* } when that part of the config is processed by the server, it fails to match here in that case the /if ((//reply:UserCategory == "faculty")/ !? so it default (else) to our 902 vlan ID : (42) if (( reply:UserCategory == "employee") || (reply:UserCategory == "faculty") || (reply:UserCategory == "staff" ) || (reply:UserCategory == "researcher") || (reply:UserCategory == "member")) -> FALSE (42) elsif ( (reply:UserCategory == "student" ) || (reply:UserCategory == "affiliate") ) { (42) elsif ( (reply:UserCategory == "student" ) || (reply:UserCategory == "affiliate") ) *-> FALSE* (42) else { (42) update reply { (42) Tunnel-Private-Group-Id *:= 902* it is as if the User-Category value (or attribute itself) is not known at this stage . is there a way to print the value of the an attribute to check it's *name* and*value* ? I am confused by the attribute name itself, you might have noticed in my vlanaffect.conf I use UserCategory but in ldap module it is named User*-*Category (note the - between User and Category) ! It is so because if in vlanaffect.conf I name it occordingly to ldap module (User*-*Category) strangely I get Errors in runing radiusd -X : (34) if (( reply:User-Category == "employee") || (reply:User-Category == "faculty") || (reply:User-Category == "staff" ) || (reply:User-Category == "researcher") || (reply:User-Category == "member")) { (34) *ERROR: Failed retrieving values required to evaluate condition* (34) elsif ( (reply:User-Category == "student" ) || (reply:User-Category == "affiliate") ) { (34) ERROR: Failed retrieving values required to evaluate condition (34) else { (34) update reply { (34) Tunnel-Private-Group-Id := 902 there might be a mistake somewhere, but I cannot figure out where , how can I debug ldap / radius attribute name/values matchs ? Thanks for your help . PS: I run : # rpm -qa | grep radius freeradius-ldap-3.0.13-8.el7_4.x86_64 freeradius-3.0.13-8.el7_4.x86_64 freeradius-utils-3.0.13-8.el7_4.x86_64
On Thu, 2018-08-30 at 19:06 +0200, jehan procaccia INT wrote:
2) running radiusd -X I do see the ldap query and attribute returned correclty
rlm_ldap (prod): Reserved connection (3) (41) prod: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (41) prod: --> (uid=teststud)
...
(41) prod: Processing user attributes (41) prod: control:Password-With-Header += '{CRYPT}secretaoSOObH1' (41) prod: control:NT-Password += secret3735323731 (41) prod: reply:Reply-Message := 'faculty' (41) prod: reply:*User-Category += 'faculty'* rlm_ldap (prod): Released connection (3) (41) [prod] = updated
OK
* if (*( reply:UserCategory == "employee") || (reply:*UserCategory == "faculty"*) || (reply:UserCategory == "staff" )
(reply:UserCategory == "researcher") || (reply:UserCategory ==
"member")) { update reply { Tunnel-Private-Group-Id :=*903* }
Use &reply:User-Category, etc
is there a way to print the value of the an attribute to check it's *name* and*value* ?
debug_reply If it's not there... is this the same RADIUS packet? e.g. you set User-Category in one packet, and then checking it again in the next packet. If so, use the session-state: list instead of reply:.
I am confused by the attribute name itself, you might have noticed in my vlanaffect.conf I use UserCategory but in ldap module it is named User*-*Category (note the - between User and Category) ! It is so because if in vlanaffect.conf I name it occordingly to ldap module (User*-*Category) strangely I get Errors in runing radiusd -X :
If you use different names for the attribute then it's not going to work... Try with the & before the attribute name. -- Matthew
My reponses below Le 30/08/2018 à 19:32, Matthew Newton a écrit :
On Thu, 2018-08-30 at 19:06 +0200, jehan procaccia INT wrote:
2) running radiusd -X I do see the ldap query and attribute returned correclty
rlm_ldap (prod): Reserved connection (3) (41) prod: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (41) prod: --> (uid=teststud)
...
(41) prod: Processing user attributes (41) prod: control:Password-With-Header += '{CRYPT}secretaoSOObH1' (41) prod: control:NT-Password += secret3735323731 (41) prod: reply:Reply-Message := 'faculty' (41) prod: reply:*User-Category += 'faculty'* rlm_ldap (prod): Released connection (3) (41) [prod] = updated OK
* if (*( reply:UserCategory == "employee") || (reply:*UserCategory == "faculty"*) || (reply:UserCategory == "staff" )
(reply:UserCategory == "researcher") || (reply:UserCategory == "member")) { update reply { Tunnel-Private-Group-Id :=*903* }
Use &reply:User-Category, etc I did that , but still fails with now the error :
(30) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (30) *ERROR: Failed retrieving values required to evaluate condition* (30) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (30) ERROR: Failed retrieving values required to evaluate condition (30) else { (30) update reply { (30) Tunnel-Private-Group-Id := 902 then it is still not clear wether my attribute is named User-Category or UserCategory (without "-") !? and what's the difference between reply and &reply ? from https://wiki.freeradius.org/config/run_time_variables#attributes-as-environm... I see that "-" should be replaced by "_" , but that's for shell rlm_exec not rlm_ldap ? now if I set in vlanaffect.conf if (( *&*reply:UserCategory == "employee") || (*&reply:UserCategory* == "faculty") || (*&*reply:UserCategory == "staff" ) || (*&*reply:UserCategory == "researcher") || (*&*reply:UserCategory == "member")) { update reply { Tunnel-Private-Group-Id := 903 radiusd -X fails on : /} # server default// ///etc/raddb/sites-enabled/../vlanaffect.conf[3]: Unknown attribute 'UserCategory'/ in mods-available/ldap I have the following mapping ldap prod { update { reply:User-Category += 'eduPersonPrimaryAffiliation' should (can ?) I rename :User-Category to :UserCategory here ?
is there a way to print the value of the an attribute to check it's *name* and*value* ? debug_reply
where do you set that ? I do see in policy.d/debug debug_reply { if("%{debug_attr:reply:}" == '') { noop } does it mean it is set alredy ?
If it's not there... is this the same RADIUS packet? e.g. you set User-Category in one packet, and then checking it again in the next packet. If so, use the session-state: list instead of reply:.
I use eduroam with peap mschapv2 (inner-tunnel) , maybe different radius packets are involved, it would be in my vlanaffec script that I would change reply with session-state ? thanks .
I am confused by the attribute name itself, you might have noticed in my vlanaffect.conf I use UserCategory but in ldap module it is named User*-*Category (note the - between User and Category) ! It is so because if in vlanaffect.conf I name it occordingly to ldap module (User*-*Category) strangely I get Errors in runing radiusd -X : If you use different names for the attribute then it's not going to work...
Try with the & before the attribute name.
On Thu, 2018-08-30 at 22:55 +0200, jehan procaccia int wrote:
I did that , but still fails with now the error :
(30) if (( &reply:User-Category == "employee") || (&reply:User- Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (30) ERROR: Failed retrieving values required to evaluate condition (30) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (30) ERROR: Failed retrieving values required to evaluate condition (30) else { (30) update reply { (30) Tunnel-Private-Group-Id := 902
So put debug_reply above that line and see if the attribute has been set there.
then it is still not clear wether my attribute is named User-Category or UserCategory (without "-") !?
Look in the dictionary. It is "User-Category".
and what's the difference between reply and &reply ?
&reply says to use the attribute value. In v2 you didn't need to say that. You should in v3 to save ambiguity.
/etc/raddb/sites-enabled/../vlanaffect.conf[3]: Unknown attribute 'UserCategory'
Because it's User-Category.
in mods-available/ldap I have the following mapping
ldap prod { update { reply:User-Category += 'eduPersonPrimaryAffiliation'
should (can ?) I rename :User-Category to :UserCategory here ?
No
is there a way to print the value of the an attribute to check it's *name* and*value* ?
debug_reply where do you set that ? I do see in policy.d/debug
Where you need to find out what the reply list contains. As above.
I use eduroam with peap mschapv2 (inner-tunnel) , maybe different radius packets are involved, it would be in my vlanaffec script that I would change reply with session-state ?
Change all reply:User-Category to session-state:User-Category. But find out whether it's set or not first. -- Matthew
Le 30/08/2018 à 23:12, Matthew Newton a écrit :
On Thu, 2018-08-30 at 22:55 +0200, jehan procaccia int wrote:
I did that , but still fails with now the error :
(30) if (( &reply:User-Category == "employee") || (&reply:User- Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (30) ERROR: Failed retrieving values required to evaluate condition (30) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (30) ERROR: Failed retrieving values required to evaluate condition (30) else { (30) update reply { (30) Tunnel-Private-Group-Id := 902 So put
debug_reply
above that line and see if the attribute has been set there. ok did that, radiusd -X tells now :
(30) Login OK: [barnabot/<via Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (30) } # server inner-tunnel (30) Virtual server sending reply (30) Reply-Message := "student" (30) User-Category += "student" (31) # Executing section post-auth from file /etc/raddb/sites-enabled/default (31) post-auth { (31) update { (31) No attributes updated (31) } # update = noop (31) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (31) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180831 (31) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.91.10.10/reply-detail-20180831 (31) reply_log: EXPAND %t (31) reply_log: --> Fri Aug 31 00:17:54 2018 (31) [reply_log] = ok (31) [exec] = noop (31) policy remove_reply_message_if_eap { (31) if (&reply:EAP-Message && &reply:Reply-Message) { (31) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (31) else { (31) [noop] = noop (31) } # else = noop (31) } # policy remove_reply_message_if_eap = noop (31) policy debug_reply { (31) if ("%{debug_attr:reply:}" == '') { (31) Attributes matching "reply:" (31) &reply:MS-MPPE-Recv-Key = 0x6e1bcf8ea79f6d06a6dce39f4aadf79dfbd946f7ca2438a30d68f176073aa595 (31) &reply:MS-MPPE-Send-Key = 0xf482d9f73fb33affff0a965215b2135921b3800f4aa1424e26dae3359fdd6085 (31) &reply:EAP-MSK = 0x6e1bcf8ea79f6d06a6dce39f4aadf79dfbd946f7ca2438a30d68f176073aa595f482d9f73fb33affff0a965215b2135921b3800f4aa1424e26dae3359fdd6085 (31) &reply:EAP-EMSK = 0x7bd50d3a425c00863320ed8dcaf30139a70d382d510676d6daa81356f3f7d35e3dd4440c3c69f0ffc565c7669084e73975bef6b48c070b04aa49078ef0896939 (31) &reply:EAP-Session-Id = 0x192ca3956f79a7c3273beefed12454cddbc3402f348227b76d8faf4afcaac233e1d2a4d4993d3e3b6be9a674182fd4da47dc086e505b65ffe9233cb93974cd930e (31) &reply:EAP-Message = 0x030c0004 (31) &reply:Message-Authenticator = 0x00000000000000000000000000000000 (31) &reply:Stripped-User-Name = barnabot (31) EXPAND %{debug_attr:reply:} (31) --> (31) if ("%{debug_attr:reply:}" == '') -> TRUE (31) if ("%{debug_attr:reply:}" == '') { (31) [noop] = noop (31) } # if ("%{debug_attr:reply:}" == '') = noop (31) } # policy debug_reply = noop (31) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (31) ERROR: Failed retrieving values required to evaluate condition (31) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (31) ERROR: Failed retrieving values required to evaluate condition (31) else { (31) update reply { (31) Tunnel-Private-Group-Id := 902 I don't see new information regarding my User-Category attribute , perhaps because it is not set at this stage !?
I use eduroam with peap mschapv2 (inner-tunnel) , maybe different radius packets are involved, it would be in my vlanaffec script that I would change reply with session-state ? Change all reply:User-Category to session-state:User-Category.
But find out whether it's set or not first.
That's my next step , it's getting late here in France, I'll try that on site tomorrow . thanks .
unfortunatly it fails, User-Category attribute fetch from ldap edupersonPrimaryAffiliation doesn't pass though different states/modules apparently even with the usage of session-state (replacing "reply") it fails here's a new radiusd -X experiment : 1) ldap does find the attribute and associated value (here employee) rlm_ldap (prod): Reserved connection (7) (93) prod: reply:Reply-Message := 'employee' (93) prod: reply:User-Category += 'employee' 2) eap-peap has it (93) post-auth { (93) if (0) { (93) if (0) -> FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } # server inner-tunnel (93) Virtual server sending reply (93) Reply-Message := "employee" (93) *User-Category += "employee"* (93) eap_peap: Got tunneled reply code 2 (93) eap_peap: Reply-Message := "employee" (93) eap_peap: *User-Category += "employee"* 3) eap_peap is success (94)*eap_peap: Success* (94) eap: Sending EAP Success (code 3) ID 12 length 4 (94) eap: Freeing handler (94) [eap] = ok (94) } # authenticate = ok (94) # Executing section post-auth from file /etc/raddb/sites-enabled/default (94) post-auth { (94) update { (94) No attributes updated (94) } # update = noop (94) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (94) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180831 (94) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.91.10.10/reply-detail-20180831 (94) reply_log: EXPAND %t (94) reply_log: --> Fri Aug 31 10:26:47 2018 (94) [reply_log] = ok (94) [exec] = noop (94) policy remove_reply_message_if_eap { (94) if (&reply:EAP-Message && &reply:Reply-Message) { (94) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE 4) but when entering my vlan affectaction script included from sites-enabled/default , with debug_reply and session-state here (94) policy *debug_reply* { (94) if ("%{debug_attr:reply:}" == '') { (94) Attributes matching "reply:" (94) &reply:MS-MPPE-Recv-Key = 0x6951a718ea2d0ce60f3f210a7d3bdf8d2bbc6f05a1efa5f48966ae507a7c8986 (94) &reply:MS-MPPE-Send-Key = 0x646babfc1284ac415770097bcfebd01a00a7fcaab056bbe3c28355dcf6e33b6e (94) &reply:EAP-MSK = 0x6951a718ea2d0ce60f3f210a7d3bdf8d2bbc6f05a1efa5f48966ae507a7c8986646babfc1284ac415770097bcfebd01a00a7fcaab056bbe3c28355dcf6e33b6e (94) &reply:EAP-EMSK = 0x839cec06f72c16eb9591871f4202ef7fa8a562c9584bc86284e00f6c96ba6bd87ec87a716e93b5d956272e23b960d02e2e13a78b26bca0c63dd8dce5b322fd2f (94) &reply:EAP-Session-Id = 0x195b88fbc71b5d48c99581f08d4b9c8db9d6fffdc8bf6ff48d2f41072b54010f6458949fbe030ace473886247929495cea59c6c2c6ba7ea128f3766e4668b75529 (94) &reply:EAP-Message = 0x030c0004 (94) &reply:Message-Authenticator = 0x00000000000000000000000000000000 (94) &reply:Stripped-User-Name = radu (94) EXPAND %{debug_attr:reply:} (94) --> should I see something like &reply:User-Category above ? not been present means it's already lost ? indeed, just after, when I test on it (94) if ("%{debug_attr:reply:}" == '') -> TRUE (94) if ("%{debug_attr:reply:}" == '') { (94) [noop] = noop (94) } # if ("%{debug_attr:reply:}" == '') = noop (94) } # policy debug_reply = noop (94) *if (( **&session-state:User-Category****== "employee"**)* || (&session-state:User-Category == "faculty") || (&session-state:User-Category == "staff" ) || (&session-state:User-Category == "researcher") || (&session-state:User-Category == "member")) { (94) *ERROR: Failed retrieving values required to evaluate condition* (94) elsif ( (&session-state:User-Category == "student" ) || (&session-state:User-Category == "affiliate") ) { (94) ERROR: Failed retrieving values required to evaluate condition (94) else { (94) update reply { (94) Tunnel-Private-Group-Id := 902 I am lost why this User-Category attribute desepearing in the process do you have an idea , or another step forward to debug more ? Thanks . Le 31/08/2018 à 00:49, jehan procaccia INT a écrit :
Le 30/08/2018 à 23:12, Matthew Newton a écrit :
On Thu, 2018-08-30 at 22:55 +0200, jehan procaccia int wrote:
I did that , but still fails with now the error :
(30) if (( &reply:User-Category == "employee") || (&reply:User- Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (30) ERROR: Failed retrieving values required to evaluate condition (30) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (30) ERROR: Failed retrieving values required to evaluate condition (30) else { (30) update reply { (30) Tunnel-Private-Group-Id := 902 So put
debug_reply
above that line and see if the attribute has been set there. ok did that, radiusd -X tells now :
(30) Login OK: [barnabot/<via Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (30) } # server inner-tunnel (30) Virtual server sending reply (30) Reply-Message := "student" (30) User-Category += "student"
(31) # Executing section post-auth from file /etc/raddb/sites-enabled/default (31) post-auth { (31) update { (31) No attributes updated (31) } # update = noop (31) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (31) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180831 (31) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.91.10.10/reply-detail-20180831 (31) reply_log: EXPAND %t (31) reply_log: --> Fri Aug 31 00:17:54 2018 (31) [reply_log] = ok (31) [exec] = noop (31) policy remove_reply_message_if_eap { (31) if (&reply:EAP-Message && &reply:Reply-Message) { (31) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (31) else { (31) [noop] = noop (31) } # else = noop (31) } # policy remove_reply_message_if_eap = noop
(31) policy debug_reply { (31) if ("%{debug_attr:reply:}" == '') { (31) Attributes matching "reply:" (31) &reply:MS-MPPE-Recv-Key = 0x6e1bcf8ea79f6d06a6dce39f4aadf79dfbd946f7ca2438a30d68f176073aa595 (31) &reply:MS-MPPE-Send-Key = 0xf482d9f73fb33affff0a965215b2135921b3800f4aa1424e26dae3359fdd6085 (31) &reply:EAP-MSK = 0x6e1bcf8ea79f6d06a6dce39f4aadf79dfbd946f7ca2438a30d68f176073aa595f482d9f73fb33affff0a965215b2135921b3800f4aa1424e26dae3359fdd6085 (31) &reply:EAP-EMSK = 0x7bd50d3a425c00863320ed8dcaf30139a70d382d510676d6daa81356f3f7d35e3dd4440c3c69f0ffc565c7669084e73975bef6b48c070b04aa49078ef0896939 (31) &reply:EAP-Session-Id = 0x192ca3956f79a7c3273beefed12454cddbc3402f348227b76d8faf4afcaac233e1d2a4d4993d3e3b6be9a674182fd4da47dc086e505b65ffe9233cb93974cd930e (31) &reply:EAP-Message = 0x030c0004 (31) &reply:Message-Authenticator = 0x00000000000000000000000000000000 (31) &reply:Stripped-User-Name = barnabot (31) EXPAND %{debug_attr:reply:} (31) --> (31) if ("%{debug_attr:reply:}" == '') -> TRUE (31) if ("%{debug_attr:reply:}" == '') { (31) [noop] = noop (31) } # if ("%{debug_attr:reply:}" == '') = noop (31) } # policy debug_reply = noop (31) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (31) ERROR: Failed retrieving values required to evaluate condition (31) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (31) ERROR: Failed retrieving values required to evaluate condition (31) else { (31) update reply { (31) Tunnel-Private-Group-Id := 902
I don't see new information regarding my User-Category attribute , perhaps because it is not set at this stage !?
I use eduroam with peap mschapv2 (inner-tunnel) , maybe different radius packets are involved, it would be in my vlanaffec script that I would change reply with session-state ? Change all reply:User-Category to session-state:User-Category.
But find out whether it's set or not first.
That's my next step , it's getting late here in France, I'll try that on site tomorrow .
thanks .
On Aug 31, 2018, at 4:45 AM, jehan procaccia INT <jehan.procaccia@int-evry.fr> wrote:
unfortunatly it fails, User-Category attribute fetch from ldap edupersonPrimaryAffiliation doesn't pass though different states/modules apparently
Yes, it does. You should be able to tell what's going on by reading the debug output. *Or* by posting the ENTIRE debug output here, and letting someone else read it. You're falling into a common trap. You're trying all kinds of random things. Without really understanding what's going on, or why. You're posting *small* bits of the debug output, in the hope that those bits are useful. They're not. Post the FULL DEBUG OUTPUT. And make sure it's for ONE USER. We're not going to read through thousands of lines of logs about accounting packets, in order to solve an authentication issue.
even with the usage of session-state (replacing "reply") it fails
here's a new radiusd -X experiment :
1) ldap does find the attribute and associated value (here employee)
rlm_ldap (prod): Reserved connection (7) (93) prod: reply:Reply-Message := 'employee' (93) prod: reply:User-Category += 'employee'
2) eap-peap has it
(93) post-auth { (93) if (0) { (93) if (0) -> FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } # server inner-tunnel (93) Virtual server sending reply (93) Reply-Message := "employee" (93) *User-Category += "employee"* (93) eap_peap: Got tunneled reply code 2 (93) eap_peap: Reply-Message := "employee" (93) eap_peap: *User-Category += "employee"*
Note that's all in packet 93. AND in the "inner tunnel" virtual server.
3) eap_peap is success
(94)*eap_peap: Success*
Which is packet 94. Note that "94" is NOT THE SAME as "93". i.e. it's a different packet. So unless you made sure to get the attribute from packet 93 inner tunnel reply to packet 94 outer reply... the attribute won't be in packet 94.
should I see something like &reply:User-Category above
No.
? not been present means it's already lost ?
It hasn't been lost. All you need to do is read mods-available/eap, and set "use_tunneled_reply = yes". And read the comments for that configuration item. They explain what it is, why you need it, and when you want to use it. Alan DeKok.
Hello sucessfull reponses below ... Le 31/08/2018 à 14:59, Alan DeKok a écrit :
On Aug 31, 2018, at 4:45 AM, jehan procaccia INT <jehan.procaccia@int-evry.fr> wrote:
unfortunatly it fails, User-Category attribute fetch from ldap edupersonPrimaryAffiliation doesn't pass though different states/modules apparently Yes, it does. You should be able to tell what's going on by reading the debug output. *Or* by posting the ENTIRE debug output here, and letting someone else read it.
You're falling into a common trap. You're trying all kinds of random things. Without really understanding what's going on, or why. You're posting *small* bits of the debug output, in the hope that those bits are useful.
They're not.
Post the FULL DEBUG OUTPUT.
And make sure it's for ONE USER. We're not going to read through thousands of lines of logs about accounting packets, in order to solve an authentication issue. you're right, after a weekend reading thouroughly http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf and wiki thingsget better now , althought it's not easy to get a single user debug output from production . fortunatly you gave me the right answer with
"use_tunneled_reply = yes" adding that not only (which was already set) to mods-enabled/eap section: eap { ttls { but moreover to peap { which is our prevalent method used, now makes the attribute correctly flowed in the process chapter 4.3 of the tech guide is important to understand the iteractive / recursive processing of the configuration sections and modules . the debug output seems very repetitive whitout that and https://wiki.freeradius.org/guide/radiusd-X helps a lot to . thanks for your help , now it work fine ;-) Regards PS my connection as an employee (ldap) and associated vlan accordingly : (86) prod: reply:Reply-Message := 'employee' (86) prod: reply:User-Category += 'employee' (86) Virtual server sending reply (86) Reply-Message := "employee" (86) User-Category += "employee" (86) eap_peap: Got tunneled reply RADIUS code 2 (86) eap_peap: Reply-Message := "employee" (86) eap_peap: User-Category += "employee" (88) eap_peap: Using saved attributes from the original Access-Accept (88) eap_peap: Reply-Message := "employee" (88) eap_peap: User-Category += "employee" (88) [eap] = ok (88) } # authenticate = ok (88) # Executing section post-auth from file /etc/raddb/sites-enabled/default (88) post-auth { (88) update { (88) No attributes updated (88) } # update = noop (88) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180903 (88) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: EXPAND %t (88) reply_log: --> Mon Sep 3 09:24:23 2018 (88) [reply_log] = ok (88) [exec] = noop (88) policy remove_reply_message_if_eap { (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) update reply { (88) &Reply-Message !* ANY (88) } # update reply = noop (88) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (88) ... skipping else: Preceding "if" was taken (88) } # policy remove_reply_message_if_eap = noop (88) policy debug_reply { (88) if ("%{debug_attr:reply:}" == '') { (88) Attributes matching "reply:" (88) &reply:User-Category += employee (88) &reply:Stripped-User-Name = procacci (88) if ("%{debug_attr:reply:}" == '') -> TRUE (88) if ("%{debug_attr:reply:}" == '') { (88) [noop] = noop (88) } # if ("%{debug_attr:reply:}" == '') = noop (88) } # policy debug_reply = noop (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) -> TRUE (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) update reply { (88) Tunnel-Private-Group-Id := 903
even with the usage of session-state (replacing "reply") it fails
here's a new radiusd -X experiment :
1) ldap does find the attribute and associated value (here employee)
rlm_ldap (prod): Reserved connection (7) (93) prod: reply:Reply-Message := 'employee' (93) prod: reply:User-Category += 'employee'
2) eap-peap has it
(93) post-auth { (93) if (0) { (93) if (0) -> FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } # server inner-tunnel (93) Virtual server sending reply (93) Reply-Message := "employee" (93) *User-Category += "employee"* (93) eap_peap: Got tunneled reply code 2 (93) eap_peap: Reply-Message := "employee" (93) eap_peap: *User-Category += "employee"* Note that's all in packet 93. AND in the "inner tunnel" virtual server.
3) eap_peap is success
(94)*eap_peap: Success* Which is packet 94. Note that "94" is NOT THE SAME as "93".
i.e. it's a different packet. So unless you made sure to get the attribute from packet 93 inner tunnel reply to packet 94 outer reply... the attribute won't be in packet 94.
should I see something like &reply:User-Category above No.
? not been present means it's already lost ? It hasn't been lost.
All you need to do is read mods-available/eap, and set "use_tunneled_reply = yes". And read the comments for that configuration item. They explain what it is, why you need it, and when you want to use it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
jehan procaccia INT -
jehan procaccia int
-
Matthew Newton