Check EAP Type in Unlang/Post Auth
Hi , I am trying to configure an unlang condition in the post auth section of the virtual server which effectively needs to be able to do the following: //This is my way of trying to explain the requirements not the real unlang syntax :) if(eap-type == "PEAP"){ VSA:=Blah } elseif(eap-type=="TLS") { VSA:=Blah } Which effectively tells the NAS that if a user is using User/pass dump them in VLAN A if User using certs dump them in vlan B. Is this possible if so can someone tell me what the syntax will look like/atrributes to check for. Thanks in advance. Arnab
On Wed, Apr 26, 2017 at 12:40:11PM +0200, Arnab Roy wrote:
//This is my way of trying to explain the requirements not the real unlang syntax :) if(eap-type == "PEAP"){
VSA:=Blah
} elseif(eap-type=="TLS") { VSA:=Blah }
Something like if (EAP-Type == "PEAP") { # PEAP update reply { ... } } elsif (EAP-Type == "TLS") { # EAP-TLS update reply { ... } } else { # default case update reply { ... } } I can't remember offhand exactly where EAP-Type is available - you may need to do it in the inner-tunnel and copy the attributes back to the outer. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
//This is my way of trying to explain the requirements not the real unlang syntax :) if(eap-type == "PEAP"){
VSA:=Blah
} elseif(eap-type=="TLS") { VSA:=Blah } Something like if (EAP-Type == "PEAP") { # PEAP update reply { ... } } elsif (EAP-Type == "TLS") { # EAP-TLS update reply { ... } } else { # default case update reply { ... } } I can't remember offhand exactly where EAP-Type is available - you may need to do it in the inner-tunnel and copy the attributes back to the outer. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, I tried this if(EAP-Type== "PEAP"){ update reply { Aruba-User-Role = "guest" } } In both and inner and outer servers it never matches that rule. Any further suggestions. Cheers Arnab Sent: Wednesday, April 26, 2017 at 12:01 PM From: "Matthew Newton" <mcn4@leicester.ac.uk> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Subject: Re: Check EAP Type in Unlang/Post Auth On Wed, Apr 26, 2017 at 12:40:11PM +0200, Arnab Roy wrote: - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html References 1. http://www.freeradius.org/list/users.html
Hi , After further testing it appears that EAP-Type only exists in the outer server post with section. Can someone tell me at what point this is populated. Having it in the outer server is not very helpful as I'm trying to combine it with ldap group lookups which can only safely happen in the inner tunnel(outer identity could be anonymous) Any way I can access this attribute in the inner tunnel may be save the value in a temp attribute? Your help is appreciated. Many Thanks Arnab
Hi, Save it as a session attribute and check in post auth of outer. BR, Anirudh Malhotra 8zero2
On 27-Apr-2017, at 12:49 PM, Arnab Roy <arnabroy@mail.com> wrote:
Hi , After further testing it appears that EAP-Type only exists in the outer server post with section. Can someone tell me at what point this is populated. Having it in the outer server is not very helpful as I'm trying to combine it with ldap group lookups which can only safely happen in the inner tunnel(outer identity could be anonymous) Any way I can access this attribute in the inner tunnel may be save the value in a temp attribute? Your help is appreciated. Many Thanks Arnab - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have tried that now and it looks like the attribute is only populated during outer post auth. Which means inner processing is already finished. So we have a chicken and egg situation :)
On 27 April 2017 08:51:38 BST, Arnab Roy <arnabroy@mail.com> wrote:
I have tried that now and it looks like the attribute is only populated during outer post auth. Which means inner processing is already finished. So we have a chicken and egg situation :)
Should be in inner authorize section IIRC. Otherwise you can get it from EAP-Message with a regexp if you're desperate. -- Matthew
Hi, Again, read about "session-state” variables you can assign these variables in inner tunnel and use them in outer. BR, Anirudh Malhotra 8zero2
On 27-Apr-2017, at 1:21 PM, Arnab Roy <arnabroy@mail.com> wrote:
I have tried that now and it looks like the attribute is only populated during outer post auth. Which means inner processing is already finished. So we have a chicken and egg situation :) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
the EAP type is known to the server - and this can be passed through to the inner-tunnel (you need to pass this attribute through. obviously, SOME EAP types - eg EAP-TLS dont ever touch the inner-tunnel.... alan
participants (5)
-
8zero2 operations -
Alan Buxey -
Arnab Roy -
Matthew Newton -
Matthew Newton