Freeradius capable of url-redirect
Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2. I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access. http://www.cisco.com/en/US/products/ps6366/products_configuration_example091 86a0080956185.shtml Is this handled somehow is Freeradius?
On Wed, Sep 08, 2010 at 10:25:41AM -0400, Nathan McDavit-Van Fleet wrote:
Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2.
I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access.
http://www.cisco.com/en/US/products/ps6366/products_configuration_example091 86a0080956185.shtml
Is this handled somehow is Freeradius?
Per the included link: You can specify the redirect page on the Remote Authentication Dial-In User Service (RADIUS) server. The RADIUS server should be configured to return the Cisco av-pair url-redirect RADIUS attribute to the Wireless LAN Controller upon successful 802.1x authentication. This is normal radius server functionality and is supported by freeradius. Cheers, Ken
Thanks Ken, Is there existing documentation for this? I have searched for url redirection and the attribute names but I haven't found anything for freeradius. I'm not much of a FR guru so I don't have much of a mind for how I could put it together from scratch. -Nathan
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Kenneth Marshall Sent: Wednesday, September 08, 2010 10:39 AM To: FreeRadius users mailing list Subject: Re: Freeradius capable of url-redirect
On Wed, Sep 08, 2010 at 10:25:41AM -0400, Nathan McDavit-Van Fleet wrote:
Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2.
I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access.
http://www.cisco.com/en/US/products/ps6366/products_configuration_examp le091
86a0080956185.shtml
Is this handled somehow is Freeradius?
Per the included link:
You can specify the redirect page on the Remote Authentication Dial-In User Service (RADIUS) server. The RADIUS server should be configured to return the Cisco av-pair url-redirect RADIUS attribute to the Wireless LAN Controller upon successful 802.1x authentication.
This is normal radius server functionality and is supported by freeradius.
Cheers, Ken - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nathan McDavit-Van Fleet wrote:
Thanks Ken,
Is there existing documentation for this? I have searched for url redirection and the attribute names but I haven't found anything for freeradius. I'm not much of a FR guru so I don't have much of a mind for how I could put it together from scratch.
FreeRADIUS includes documentation and examples for: a) giving an attribute a value b) returning that attribute in a packet. FreeRADIUS does *not* include documentation and examples for: a) how to set values for every single attribute from every vendor Read the vendor documentation for: a) what is the name of the attribute to set b) what value it should have Alan DeKok.
Okay, So my config is failing to even allow freeradius to initialize. I get the following errors in my radius.log Thu Sep 9 11:46:11 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[161]: Failed to parse "elsif" subsection. Thu Sep 9 11:46:11 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Thu Sep 9 11:46:11 2010 : Error: Failed to load virtual server inner-tunnel Thu Sep 9 11:46:22 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[165]: Unknown action 'http://cisco.com"'. Thu Sep 9 11:46:22 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[161]: Failed to parse "elsif" subsection. Thu Sep 9 11:46:22 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Thu Sep 9 11:46:22 2010 : Error: Failed to load virtual server inner-tunnel My config is Cisco-AVpair+="http:url-redirect=http://www.cisco.com" Apparently this is not properly formatted. I found several examples where this should be alright. I've tried with the protocol "ip" and others, but I don't even think that the protocol matters in terms of how freeradius parses it? -Nathan
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, September 08, 2010 12:12 PM To: FreeRadius users mailing list Subject: Re: Freeradius capable of url-redirect
Nathan McDavit-Van Fleet wrote:
Thanks Ken,
Is there existing documentation for this? I have searched for url redirection and the attribute names but I haven't found anything for freeradius. I'm not much of a FR guru so I don't have much of a mind for how I could put it together from scratch.
FreeRADIUS includes documentation and examples for:
a) giving an attribute a value
b) returning that attribute in a packet.
FreeRADIUS does *not* include documentation and examples for:
a) how to set values for every single attribute from every vendor
Read the vendor documentation for:
a) what is the name of the attribute to set
b) what value it should have
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nathan McDavit-Van Fleet wrote:
Okay,
So my config is failing to even allow freeradius to initialize. I get the following errors in my radius.log
Thu Sep 9 11:46:11 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[161]: Failed to parse "elsif" subsection.
So... what does that section of the file contain?
My config is
Cisco-AVpair+="http:url-redirect=http://www.cisco.com"
You have a *bit* more than one line of text in your configuration. Perhaps you could post the *context*? Like the entire "elsif" section it's complaining about?
Apparently this is not properly formatted. I found several examples where this should be alright. I've tried with the protocol "ip" and others, but I don't even think that the protocol matters in terms of how freeradius parses it?
You have likely read the examples wrong. The examples show specific configurations in specific files. If you follow the examples *exactly*, they will work. They will even work if you then edit them to change the attribute name and value. What you've done is probably to take an example intended for the "users" file, and put it somewhere else. Read "man unlang" for the format of the configuration files. It also explains how to set attributes. i.e. This *is* documented. Alan DeKok.
I have in post-auth: If(outer.NAS-IP-Address == x.x.x.x) { Cisco-AVPair += "http:url-redirect=http://www.cisco.com" } Since Cisco's documentation doesn't provide any information for url-redirect aside from inside Cisco ACS, I don't know where exactly to put this code. The only thing I know is that it's after authentication so that's where I put it. I've indeed seen most of the config examples in user-specific configurations. I have seen Cisco-AVPair += "lcp:interace-config vrf forwarding CHL-PRIVATE" in policy as well. -Nathan
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, September 09, 2010 12:57 PM To: FreeRadius users mailing list Subject: Re: Freeradius capable of url-redirect
Nathan McDavit-Van Fleet wrote:
Okay,
So my config is failing to even allow freeradius to initialize. I get the following errors in my radius.log
Thu Sep 9 11:46:11 2010 : Error: /etc/raddb/sites-enabled/inner-tunnel[161]: Failed to parse "elsif" subsection.
So... what does that section of the file contain?
My config is
Cisco-AVpair+="http:url-redirect=http://www.cisco.com"
You have a *bit* more than one line of text in your configuration.
Perhaps you could post the *context*? Like the entire "elsif" section it's complaining about?
Apparently this is not properly formatted. I found several examples where this should be alright. I've tried with the protocol "ip" and others, but I don't even think that the protocol matters in terms of how freeradius parses it?
You have likely read the examples wrong. The examples show specific configurations in specific files. If you follow the examples *exactly*, they will work. They will even work if you then edit them to change the attribute name and value.
What you've done is probably to take an example intended for the "users" file, and put it somewhere else.
Read "man unlang" for the format of the configuration files. It also explains how to set attributes.
i.e. This *is* documented.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
I have in post-auth:
If(outer.NAS-IP-Address == x.x.x.x) { Cisco-AVPair += "http:url-redirect=http://www.cisco.com" }
huh? you are checking for a condition and then trying to 'run' that Cisco attribute..... what you want to do is SET that attribute...eg if(outer.NAS-IP-Address == x.x.x.x) { update request { Cisco-AVPair += "http:url-redirect=http://www.cisco.com" } } or somesuch..... alan
I'm afraid I still can't get this to work at all. I decided to pare down my test to its simplest form. Basically I created a test user with the AVPair configuration as below. Which is basically what Cisco describes in its documentation (but with ACS). # test user test_login Cleartext-Password := "test_pass" Cisco-AVPair += "url-redirect=http://www.cisco.com/index.html", Service-Type = Outbound-User So essentially this user should indeed trigger the controller with that AVPair configuration. Later I plan on dynamically triggering it when someone authenticated using TTLs. (I've also tried "=" instead of "+=" for the AVPair). Nathan Van Fleet
-----Original Message----- From: freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org [mailto:freeradius-users- bounces+nmcdavit=alcor.concordia.ca@lists.freeradius.org] On Behalf Of Alan Buxey Sent: Thursday, September 09, 2010 2:24 PM To: FreeRadius users mailing list Subject: Re: Freeradius capable of url-redirect
Hi,
I have in post-auth:
If(outer.NAS-IP-Address == x.x.x.x) { Cisco-AVPair += "http:url-redirect=http://www.cisco.com" }
huh? you are checking for a condition and then trying to 'run' that Cisco attribute..... what you want to do is SET that attribute...eg
if(outer.NAS-IP-Address == x.x.x.x) { update request { Cisco-AVPair += "http:url-redirect=http://www.cisco.com" } }
or somesuch.....
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nathan McDavit-Van Fleet wrote:
I'm afraid I still can't get this to work at all.
Is the server sending the correct attributes to the NAS? If yes, blame the NAS. Otherwise, fix your configuration.
I decided to pare down my test to its simplest form. Basically I created a test user with the AVPair configuration as below. Which is basically what Cisco describes in its documentation (but with ACS).
# test user test_login Cleartext-Password := "test_pass" Cisco-AVPair += "url-redirect=http://www.cisco.com/index.html", Service-Type = Outbound-User
So essentially this user should indeed trigger the controller with that AVPair configuration. Later I plan on dynamically triggering it when someone authenticated using TTLs. (I've also tried "=" instead of "+=" for the AVPair).
Do simple tests to see if it works. If you have ACS, use wireshark to see what ACS sends in response, and make FreeRADIUS send the same thing. Alan DeKok.
have you found the way to conf url-redirect? thank u -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-capable-of-url-redirect-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 12 Aug 2011, at 11:28, helloFreeRadius wrote:
have you found the way to conf url-redirect? thank u
Yes... By sending the correct AVP to the NAS... Again with the seriously wanting to block posing from nabble... grrrrr Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
Arran Cudbard-Bell-5 wrote:
On 12 Aug 2011, at 11:28, helloFreeRadius wrote:
have you found the way to conf url-redirect? thank u
Yes... By sending the correct AVP to the NAS...
Again with the seriously wanting to block posing from nabble... grrrrr
Arran Cudbard-Bell a.cudbardb@freeradius.org
RADIUS - Half the complexity of Diameter
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
really? I'm new to freeRadius, and I'm confused with it. my configuration:( freeradius 2.1.11, cisco 3550) ----"users": testuser Cleartext-Password := "testuser" cisco-avpair = "url-redirect=http://10.32.9.41", cisco-avpair += "url-redirect-acl=redirect_acl" ----Switch port: interface FastEthernet0/7 switchport access vlan 10 switchport mode access ip access-group default_acl in dot1x mac-auth-bypass dot1x pae authenticator dot1x port-control auto dot1x violation-mode protect dot1x timeout tx-period 10 spanning-tree portfast ----ACL: Switch#show access-lists Extended IP access list default_acl 10 permit ip any any Extended IP access list redirect_acl 10 deny tcp any host 10.32.50.222 eq www 20 permit tcp any any eq www it still doesn't work. could you show me your configuration? or pick out my error? thank you very much! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-capable-of-url-redirect-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (6)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
helloFreeRadius -
Kenneth Marshall -
Nathan McDavit-Van Fleet