radclient ignores 'Group' attribute
Hello, We are switching out a client from cistron radius to FreeRadius with MySQL. To test things out without changes to the NASs, we are proxing certain realms to the new FreeRadius server. Here's our problem; the proxy works fine but the authentication (actually the user lookup) is failing when testing via radclient. The user lookup fails because the 'Group' attribute in the referenced attribute file (-f file) is being ignored (not sent) by radclient. Why is this? Is there a workaround? The Group attribute is defined in the dictionary as: ATTRIBUTE Group 1005 string The attribute file used by radclient looks like: Acct-Session-Id = "6000006B", User-Name = "example@examp.com", User-Password = "example", Group = "default", NAS-IP-Address = 127.0.0.1, NAS-Port-Id = 32, NAS-Port-Type = Async, Service-Type = Framed-User, Framed-Protocol = PPP Thanks in advance for your response. Bill
Bill Schoolfield <bill@billmax.com> wrote:
Here's our problem; the proxy works fine but the authentication (actually the user lookup) is failing when testing via radclient. The user lookup fails because the 'Group' attribute in the referenced attribute file (-f file) is being ignored (not sent) by radclient. Why is this? Is there a workaround?
The "Group" attribute is specific to the internals of FreeRADIUS. It *can't* go on the wire. Perhaps you could say what you're trying to do... Alan DeKok.
Alan, I got a little mixed up. I was thinking the sql query would use the group attribute along with the username (as though the group mechanism supported users with the same name in different groups). I know better now. What was actually happening (I should have looked at the sql closer) is one of the queries (the one for radreply) was failing because I put no user specific attributes there. Do I have to supply a dummy (constant) attribute per user? Right now, all attributes to be returned appear in the radgroupreply table. Thanks for your quick response. Bill Alan DeKok wrote:
Bill Schoolfield <bill@billmax.com> wrote:
Here's our problem; the proxy works fine but the authentication (actually the user lookup) is failing when testing via radclient. The user lookup fails because the 'Group' attribute in the referenced attribute file (-f file) is being ignored (not sent) by radclient. Why is this? Is there a workaround?
The "Group" attribute is specific to the internals of FreeRADIUS. It *can't* go on the wire.
Perhaps you could say what you're trying to do...
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Bill Schoolfield Vice President, BillMax bill@billmax.com 877.245.5629 (USA toll free) 817.446.7776 (International)
participants (2)
-
Alan DeKok -
Bill Schoolfield