Split authorization / authentication
Hi, Is it possible to split authorization step as follow : - Considering we want to authorize user using EAP and MAC adresses - http://wiki.freeradius.org/Mac-Auth works fine, but is it possible to do EAP with one radius server and MAC address auth with another one ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57
Emmanuel BILLOT wrote:
Is it possible to split authorization step as follow :
- Considering we want to authorize user using EAP and MAC adresses - http://wiki.freeradius.org/Mac-Auth works fine, but is it possible to do EAP with one radius server and MAC address auth with another one ?
Yes, but it's generally a bad idea. It adds complexity with no real purpose. FreeRADIUS can be configured to do whatever you want. It's best to keep everything in one server. Look at the debug output to see *how* those packets are different. Then, write down how you want them to be handled. Then, write the "unlang" to do it. Alan DeKok.
Le 13/06/2012 15:14, Alan DeKok a écrit :
Emmanuel BILLOT wrote:
Is it possible to split authorization step as follow :
- Considering we want to authorize user using EAP and MAC adresses - http://wiki.freeradius.org/Mac-Auth works fine, but is it possible to do EAP with one radius server and MAC address auth with another one ? Yes, but it's generally a bad idea. It adds complexity with no real purpose.
FreeRADIUS can be configured to do whatever you want. It's best to keep everything in one server.
Look at the debug output to see *how* those packets are different. Then, write down how you want them to be handled. Then, write the "unlang" to do it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Ok thanks for your answer. Possibly this is a bad idea but we have sometimes to work with obligations. What module should i use to send MAC adresses to another radius server, and getting back ok/nok before testing EAP ? Using unlang yes, but what directive should i use ? Proxy cannot be one because MAC adresse has no suffix.
-- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57
Emmanuel BILLOT wrote:
What module should i use to send MAC adresses to another radius server, and getting back ok/nok before testing EAP ?
That WILL NOT work. The server cannot proxy and also authenticate users. This is what a database is for. Put the MAC addresses into a database, and query that during the authorization phase.
Using unlang yes, but what directive should i use ? Proxy cannot be one because MAC adresse has no suffix.
If you're just going to proxy requests, you can proxy them anywhere you want, based on any criteria. Just set Proxy-To-Realm, using the realm name. The default is to proxy via domain suffixes. But other methods can also be used. There is no requirement for suffixes to be the *only* method of proxying. Alan DeKok.
Le 13/06/2012 15:48, Alan DeKok a écrit :
Emmanuel BILLOT wrote:
What module should i use to send MAC adresses to another radius server, and getting back ok/nok before testing EAP ? That WILL NOT work. The server cannot proxy and also authenticate users.
This is what a database is for. Put the MAC addresses into a database, and query that during the authorization phase.
Using unlang yes, but what directive should i use ? Proxy cannot be one because MAC adresse has no suffix. If you're just going to proxy requests, you can proxy them anywhere you want, based on any criteria. Just set Proxy-To-Realm, using the realm name.
The default is to proxy via domain suffixes. But other methods can also be used. There is no requirement for suffixes to be the *only* method of proxying.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Ok, that was what i wanted to be confirmed. Thanks a lot.
Regards, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57
participants (2)
-
Alan DeKok -
Emmanuel BILLOT