Customization of RADIUS reply
Hello I’m configuring the FreeRADIUS together with the Oracle DB. I need to get the user authenticated and in the reply provide the parameter "mailbox_fullname" from the DB. The Oracle DB has for my purpose only one view which contains the following columns. mailbox_id,mailbox_email,mailbox_fullname,mailbox_password I created new attribute in dictionary: ATTRIBUTE Full-Mailbox-Name 3000 string And customized the SQL queries as following (dialup.conf): authorize_check_query = "SELECT mailbox_id,mailbox_email,'Cleartext-Password',mailbox_password,':=' FROM ${authcheck_table} WHERE mailbox_email = '%{SQL-User-Name}' ORDER BY mailbox_id" authorize_reply_query = "SELECT mailbox_id,mailbox_email,'Full-Mailbox-Name',mailbox_fullname,':=' FROM ${authreply_table} WHERE mailbox_email = '%{SQL-User-Name}' ORDER BY mailbox_id" The user authentication works, however I need to have in the reply the value of “mailbox_fullname” from DB query. Instead of it, there is nothing. Could you please advise how to get in the reply “mailbox_fullname” for the corresponding mailbox_email? Here is the sample radtest output and in attachment full output from debug mode. radtest -x a00000012 password localhost 0 testing123 Sending Access-Request of id 26 to 127.0.0.1 port 1812 User-Name = "a00000012" User-Password = "password" NAS-IP-Address = 10.7.96.25 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=26, length=20 Thanks a lot! Vaclav
Václav Pernica wrote:
I’m configuring the FreeRADIUS together with the Oracle DB. I need to get the user authenticated and in the reply provide the parameter "mailbox_fullname" from the DB.
Does the RADIUS client understand that attribute?
The Oracle DB has for my purpose only one view which contains the following columns.
mailbox_id,mailbox_email,mailbox_fullname,mailbox_password
I created new attribute in dictionary:
ATTRIBUTE Full-Mailbox-Name 3000 string
You need to read the comments in raddb/dictionary. It explains how to send new attributes in a RADIUS packet. Hint: you're doing it wrong. This is documented.
The user authentication works, however I need to have in the reply the value of “mailbox_fullname” from DB query. Instead of it, there is nothing. Could you please advise how to get in the reply “mailbox_fullname” for the corresponding mailbox_email?
Read the file you edited: raddb/dictionary Alan DeKok.
Hello Alan Thanks for your hint.
Read the file you edited: raddb/dictionary
It works now, I just changed the number to lower value. And you are right, it is written there (even by capitals..) One more question. Is there some easy way, how to use different SQL queries (authorize_check_query, authorize_reply_query) depending on the user name prefix or suffix. E.g.: user_name@domain1 -> use SQL queries 1 user_name@domain2 -> use SQL queries 2 Thanks a lot!. Vaclav Pernica
On Tue, Sep 18, 2012 at 2:44 PM, Václav Pernica <vpl@email.cz> wrote:
One more question. Is there some easy way, how to use different SQL queries (authorize_check_query, authorize_reply_query) depending on the user name prefix or suffix.
E.g.: user_name@domain1 -> use SQL queries 1 user_name@domain2 -> use SQL queries 2
If the variant is limited, unlang might be useful. e.g. (untested): authorize { if (%{User-Name} == "user_name@domain1") { sql1 } elsif (%{User-Name} == "user_name@domain2") { sql2 } ... } see "man unlang" for details. Depending on what you need and how you configure your system, you might also be able to use Realm instead of User-Name, or use regex for comparison. -- Fajar
Václav Pernica wrote:
It works now, I just changed the number to lower value.
NO. Don't do that. All of the attribute numbers are allocated, and have pre-existing meanings. Re-using a number is WRONG. It can cause all kinds of problems.
And you are right, it is written there (even by capitals..)
You need to read and follow the REST of the instructions. They exist for a reason. They're not lying to you.
One more question. Is there some easy way, how to use different SQL queries (authorize_check_query, authorize_reply_query) depending on the user name prefix or suffix.
E.g.: user_name@domain1 -> use SQL queries 1 user_name@domain2 -> use SQL queries 2
Not easily in 2.2. Alan DeKok.
Hello Alan DeKok.wrote:
Not easily in 2.2.
What is the "not easy" approach? (in general) Fajar wrote:
see "man unlang" for details. Depending on what you need and how you configure your system, you might also be able to use Realm instead of User-Name, or use regex for comparison.
I tried to use unlang in dialup.conf or radiusd.conf, but then it fails even with simple conditions. How to do it with Realm or where to use the condition for comparison? Thanks Václav Pernica
participants (3)
-
Alan DeKok -
Fajar A. Nugraha -
Václav Pernica