Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro
Control and power. Unlang let's you configure much better policies. If you just use suffix then you end up with DEFAULT being whacked all the time. .. and your upstream proxy admins won't like you :) alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
Suffix is deprecated, it was remove from version 3.x.x because it duplicated behaviour available with unlang. If you want to use new versions of the server you don't have a choice.
suffix
do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity):
if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } }
Suffix is more magic. The logic isn't obvious to someone new to FreeRADIUS, whereas writing it out explicitly in unlang is easily understandable. It's also not obvious (by the name) that suffix will also setup proxying, as well as mangling the username. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 13 Nov 2013, at 16:50, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
Suffix is deprecated, it was remove from version 3.x.x because it duplicated behaviour available with unlang.
Apparently not removed. Still think it's a bad idea to use it though. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
ah this is the way to go. so basically disable suffix from both sites-enabled/default and sites-enabled/inner-tunnel, then have this unlang in sites-enabled/default authorized section -- nice ok now you are also proxing sub-domain.iscte.pt, maybe either sub-domain.iscte.pt Proxy-To-Realm := LOCAL or reject them, this way you won't proxing allpossiblesubdomain.iscte.pt to your EDUROAM, how is the correct unlang for rejecting or proxy to LOCAL for subdomain.iscte.pt ? On Wed, Nov 13, 2013 at 4:50 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
Suffix is deprecated, it was remove from version 3.x.x because it duplicated behaviour available with unlang.
If you want to use new versions of the server you don't have a choice.
suffix
do instead (ignore the if part, I know it is missing in the example
above, it is here just for the sake of clarity):
if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } }
Suffix is more magic. The logic isn't obvious to someone new to FreeRADIUS, whereas writing it out explicitly in unlang is easily understandable.
It's also not obvious (by the name) that suffix will also setup proxying, as well as mangling the username.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
to follow up on my previous answer you can achieve with this lines: if (Realm =~ /(.+?\.iscte\.pt)$/) { update reply { Reply-Message := "Sorry, We do not allow sub-domain Please contact Helpdesk" } reject } On Thu, Nov 6, 2014 at 5:08 PM, Khapare Joshi <khapare77@gmail.com> wrote:
ah this is the way to go. so basically disable suffix from both sites-enabled/default and sites-enabled/inner-tunnel, then have this unlang in sites-enabled/default authorized section -- nice
ok now you are also proxing sub-domain.iscte.pt, maybe either sub-domain.iscte.pt Proxy-To-Realm := LOCAL or reject them, this way you won't proxing allpossiblesubdomain.iscte.pt to your EDUROAM,
how is the correct unlang for rejecting or proxy to LOCAL for subdomain.iscte.pt ?
On Wed, Nov 13, 2013 at 4:50 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
Suffix is deprecated, it was remove from version 3.x.x because it duplicated behaviour available with unlang.
If you want to use new versions of the server you don't have a choice.
suffix
do instead (ignore the if part, I know it is missing in the example
above, it is here just for the sake of clarity):
if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } }
Suffix is more magic. The logic isn't obvious to someone new to FreeRADIUS, whereas writing it out explicitly in unlang is easily understandable.
It's also not obvious (by the name) that suffix will also setup proxying, as well as mangling the username.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Nov 13, 2013 at 04:34:21PM +0000, Rui Ribeiro wrote:
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
unlang is more flexible, but either option is 'correct' if it works for you. The realm module is just going to look at the realm and update Proxy-To-Realm (and Realm) in the way you do in unlang. Rather than setting DEFAULT realms, for eduroam some people prefer to create an 'eduroam' realm, and then specifically set that in Proxy-To-Realm based on the username. For example, you may not want all unknown realms going to your upstream eduroam proxy provider, which the DEFAULT realm with the suffix module will probably do (to the annoyance of your national proxy when you send them 3gppnetwork.org crap). Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 13/11/13 16:34, Rui Ribeiro wrote:
Hi,
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
The "realm" module always reads the list of realms from "proxy.conf", honouring the special realms DEFAULT and NULL (I'm ignoring the regexp syntax stuff here). Doing it manually with "unlang" lets you specify the mapping from Realm to Proxy-To-Realm yourself, and you can be more flexible and explicit about it. i.e. with "suffix" you might have: user@example.com Realm = DEFAULT Proxy-To-Realm = DEFAULT ...versus unlang you might set: user@example.com Realm = example.com Proxy-To-Realm = SOMEPROVIDER Basically, using unlang is a bit more configurable, which is particularly useful in a roaming federation like eduroam.
Rui Ribeiro wrote:
I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing
suffix
Which is simple.
do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity):
Which is more complex. Both work. You can write your own code (C / unlang) to re-do much of what the server does. Or, you can just re-use the simple configs exposed by the server. It's up to you. Alan DeKok.
participants (7)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Khapare Joshi -
Matthew Newton -
Phil Mayers -
Rui Ribeiro