hi guys i am having a hard time getting a post-proxy setup going. we have a freeradius 2.1.8 server setup for a specific realm. authentication requests are coming from a upstream provider (3g carrier) onto our radius server. our radius server sends the authentication request to another radius server (windows platform) that authenticates the user against active directory. we receive the response, either accepted or denied. if the response is 'user accepted', we must then do a mysql query to find the ip address for the relevant user from our freeradius server and ammend the ip address to the radius response back to the 3g carrier's radius server. the authentication part is working perfectly between our radius server and the microsoft radius server as we are either getting a positive or negative reponse from the microsoft radius server. Sending Access-Request of id 213 to x.x.x.x port 1812 User-Name = "jacobsb@tut.ac.za" User-Password = "Tut123" NAS-IP-Address = 127.0.1.1 NAS-Port = 8585 rad_recv: Access-Accept packet from host x.x.x.x port 1812, id=213, length=20 at this point, we need the ip address lookup to be done on the mysql server running on our freeradius server and insert the relevant information into the proxy reply back to the carrier. as far as i have been able to read up, this should be done in the post-proxy configuration using unlang at this post [ http://lists.freeradius.org/pipermail/freeradius-users/2008-May/027960.html] but I am not able to get this to work with the code as seen on the post mentioned.
* post-proxy {*>>* ...*>>* if (proxy-reply:Framed-IP-Address) {*>>* update proxy-reply {*>>* Framed-IP-Address := 1.2.3.4*>>* ...*>>* }*>>* }*>>* }*
Any pointers will be appreciated. Regards, Gabriel
Hi, if you look at freeradius running in debug mode, you can see what bits of the server are being hit and where you can do the required changes..... so post-proxy would be okay - but you update the reply alan
On Wed, May 1, 2013 at 11:15 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
if you look at freeradius running in debug mode, you can see what bits of the server are being hit and where you can do the required changes..... so post-proxy would be okay - but you update the reply
when running in debug mode, I can see this part id being hit :- [attr_filter.post-proxy] expand: %{Realm} -> tut.ac.za attr_filter: Matched entry tut.ac.za at line 115 ++[attr_filter.post-proxy] returns updated this is where i have the realm setup in the attrs file. in this section, just as a test, I have the following :- tut.ac.za Acct-Interim-Interval = 1200, To (hopefully) explicitly set the Acct-Interim-Interval but it doesn't look like it is being set when testing with radtest. not sure if i understand this correctly? regards, g
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, why are you now talkign about users file? use unlang - as you originally stated and then update the reply alan
sorry alan, perhaps I'm mixing up my examples in an attempt to get this working... 1. where (or in which file) do I add the unlang code? 2. how do i update the reply? I currently have the following code in my proxy-inner-tunnel file :- post-proxy { eap if (proxy-reply:Access-Accept) { update proxy-reply { Framed-IP-Address := "%{sql:SELECT Value FROM `radreply` WHERE UserName ='%{User-Name}' AND Attribute = 'Framed-IP-Address'}" } } when i start freeradius -X i don't get any errors. the microsoft radius box is down at the moment on the other side so I can't test any further at the moment but will get back as soon as the server is up again. tx, g On Wed, May 1, 2013 at 12:16 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
why are you now talkign about users file? use unlang - as you originally stated and then update the reply
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
sorry alan, perhaps I'm mixing up my examples in an attempt to get this working...
run your freeradius is full debug mode. LOOK at what is going on
1. where (or in which file) do I add the unlang code?
as you have
2. how do i update the reply?
by updating the reply
I currently have the following code in my proxy-inner-tunnel file :- post-proxy { eap if (proxy-reply:Access-Accept) { update proxy-reply { Framed-IP-Address := "%{sql:SELECT Value FROM `radreply` WHERE UserName ='%{User-Name}' AND Attribute = 'Framed-IP-Address'}" }
thats not updating the reply is it. thats updating the proxy-reply. alan
On Wed, May 1, 2013 at 1:22 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
sorry alan, perhaps I'm mixing up my examples in an attempt to get this working...
run your freeradius is full debug mode. LOOK at what is going on
1. where (or in which file) do I add the unlang code?
as you have
I have made the changes in the file proxy-inner-tunnel -- i'm not sure if this is where i'm supposed to be adding the change.
2. how do i update the reply?
by updating the reply
I currently have the following code in my proxy-inner-tunnel file :- post-proxy { eap if (proxy-reply:Access-Accept) { update proxy-reply { Framed-IP-Address := "%{sql:SELECT Value FROM `radreply` WHERE UserName ='%{User-Name}' AND Attribute = 'Framed-IP-Address'}" }
thats not updating the reply is it. thats updating the proxy-reply.
I changed the proxy-inner-tunnel file with the following :- post-proxy { # # This is necessary for LEAP, or if you set: # # proxy_tunneled_request_as_eap = no # eap if (proxy-reply:Acct-Interim-Interval = 900) { update reply { Framed-IP-Address := "%{sql:SELECT Value FROM `radreply` WHERE UserName ='%{User-Name}' AND Attribute = 'Framed-IP-Address'}" } } I am not sure what I should be using for the IF statement as the reply coming back from the upstream proxy looks like this :- rad_recv: Access-Accept packet from host 168.172.64.224 port 1812, id=61, length=125 Proxy-State = 0x313634 Acct-Interim-Interval = 900 Class = 0xc24109ed0000013700010200a8ac40e040e0000000000000a8ac40e001ce46617c0576420000000000002fcb MS-Link-Utilization-Threshold = 50 MS-Link-Drop-Time-Limit = 120 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x0000000e There is no IP Address in the reply, and I need to insert it at this stage before sending it back to the 3g carrier radius server.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
A.L.M.Buxey＠lboro.ac.uk -
Gabriel Marais