http://wiki.freeradius.org/SQL_HOWTO http://wiki.freeradius.org/Rlm_sql_mysql Le 04.12.2008 09:03, Matthew Carriere a écrit :

This is great thank you.

I was trying to find something in the documentation about doing this. Could anyone point me in the direction of documentation that outlines using a MySQL database for authenticating users?

Is there some kind of schema that the users table must follow?

Thanks

Matthew

On 4-Dec-08, at 1:44 AM, Alan DeKok wrote:

...

Matthew Carriere wrote:

...

I am thinking of adding a FreeRadius server to an existing infrastructure in order to provision users through an application.

FreeRADIUS authenticates users... databases provision them.

...

I am currently running a WLAN controller connecting several access points. Currently users are added manually through the WLAN controller interface.

Could I add a FreeRadius server and be able to programatically add users to it? I need to be able to do this through a Ruby on Rails application.

Install FreeRADIUS *and* MySQL. Use a RoR app to provision the database. Use FreeRADIUS to pull user information out of the database, and authenticate the users.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

That's awesome. This is a much better option than what I previously thought would be necessary to setup a development environment. Has anyone done this before in any language? Any potential issues to watch out for? Thanks. On 4-Dec-08, at 12:43 PM, <tnt@kalik.net> wrote:

You can also browse server related stuff on github. For mysql:

http://github.com/alandekok/freeradius-server/tree/master/raddb/sql/mysql

You can get the schema from there, use it and play with RoR and the database without installing freeradius.

Ivan Kalik Kalik Informatika ISP

Dana 4/12/2008, "Alexandre Chapellon" <alexandre.chapellon@mana.pf> piše:

...

http://wiki.freeradius.org/SQL_HOWTO

http://wiki.freeradius.org/Rlm_sql_mysql

Le 04.12.2008 09:03, Matthew Carriere a écrit :

...

This is great thank you.

I was trying to find something in the documentation about doing this. Could anyone point me in the direction of documentation that outlines using a MySQL database for authenticating users?

Is there some kind of schema that the users table must follow?

Thanks

Matthew

On 4-Dec-08, at 1:44 AM, Alan DeKok wrote:

...

Matthew Carriere wrote:

...

I am thinking of adding a FreeRadius server to an existing infrastructure in order to provision users through an application.

FreeRADIUS authenticates users... databases provision them.

...

I am currently running a WLAN controller connecting several access points. Currently users are added manually through the WLAN controller interface.

Could I add a FreeRadius server and be able to programatically add users to it? I need to be able to do this through a Ruby on Rails application.

Install FreeRADIUS *and* MySQL. Use a RoR app to provision the database. Use FreeRADIUS to pull user information out of the database, and authenticate the users.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

So I was taking a look at the schema's provided on Github. Can someone narrow down for me what the workflow of provisioning a user would look like? Specifically what I need to do is authorize/de-authorize users using a timestamp. So what I am thinking is: 1. I would provision users in my Rails application. 2. Authenticated users would then be added to or looked up in a FreeRadius server schema (table?) 3. FreeRadius users would need to 'timeout' or expire. Is this possible programatically? Would I have to run a sweep outside of FreeRadius to expire users? Does the mere presence of a user in a specific FreeRadius schema allow its access or does it make it 'available' to be given access? If that's the case how would I give them access programatically. I suspect there is another authorization table or something of the sort. Thanks again for the help. Matthew. On Thu, Dec 4, 2008 at 1:15 PM, <tnt@kalik.net> wrote:

...

Has anyone done this before in any language?

I've done it in ASP.NET (C#), php and perl (on separate occasions). You actually have dialup admin (php) included with the server. That is not under active development. daloRadius is (you will find the developer lurking on this list).

...

Any potential issues to watch out for?

Not much. Changes from version to version might require application alterations. Schema, attributes, operators are not set in stone.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Matthew Carriere matthew@blackninjasoftware.com

Ok this has been very helpful. So I just want to make sure I am headed down the right path. I have a WLAN controller that will be configured to use RADIUS for authentication. Currently it (WLAN) uses its own user accounts on the controller. Does this mean that the WLAN will deliver an IP after the RADIUS has authenticated the user? How does a user authenticate to the RADIUS server? Basically I need to automate the current manual task of creating the user accounts on the WLAN. 2008/12/8 <tnt@kalik.net>

http://wiki.freeradius.org/SQL_HOWTO#Populating_SQL

See also sqlcounters and Expiration attribute.

Ivan Kalik Kalik Informatika ISP

Dana 8/12/2008, "Matthew Carriere" <matthew.carriere@gmail.com> piše:

...

So I was taking a look at the schema's provided on Github. Can someone narrow down for me what the workflow of provisioning a user would look like? Specifically what I need to do is authorize/de-authorize users using a timestamp. So what I am thinking is:

1. I would provision users in my Rails application. 2. Authenticated users would then be added to or looked up in a FreeRadius server schema (table?) 3. FreeRadius users would need to 'timeout' or expire. Is this possible programatically? Would I have to run a sweep outside of FreeRadius to expire users?

Does the mere presence of a user in a specific FreeRadius schema allow its access or does it make it 'available' to be given access? If that's the case how would I give them access programatically. I suspect there is another authorization table or something of the sort.

Thanks again for the help.

Matthew.

On Thu, Dec 4, 2008 at 1:15 PM, <tnt@kalik.net> wrote:

...

...

Has anyone done this before in any language?

I've done it in ASP.NET (C#), php and perl (on separate occasions). You actually have dialup admin (php) included with the server. That is not under active development. daloRadius is (you will find the developer lurking on this list).

...

Any potential issues to watch out for?

Not much. Changes from version to version might require application alterations. Schema, attributes, operators are not set in stone.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Matthew Carriere matthew@blackninjasoftware.com

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Matthew Carriere matthew@blackninjasoftware.com

Yes I do plan on using a RoR application to make the changes to the MySQL database. So I think this is coming together. However, the username and password... where is the user responsible for using those credentials. Would a user connect to my WiFi network, then authenticate against the RADIUS server using credentials obtained through a Ruby on Rails application? Here's the workflow I am thinking to build this: 1. User connects to WiFi network. 2. User is directed to a Ruby on Rails application. 3. Application authorizes user to connect, creates credentials and propagates them to FreeRadius. 4. Application gives credentials to user. 5. User enters credentials (where?) I need hotspot functionality so I am almost there in terms of everything I need to build. Are these points rational? Also, where are the credentials entered in #5? Wouldn't I just need to deliver an IP or something to that machine at that point? Thanks Matthew. On Tue, Dec 9, 2008 at 6:00 PM, <tnt@kalik.net> wrote:

...

So I just want to make sure I am headed down the right path. I have a WLAN controller that will be configured to use RADIUS for authentication. Currently it (WLAN) uses its own user accounts on the controller. Does this mean that the WLAN will deliver an IP after the RADIUS has authenticated the user?

Yes.

...

How does a user authenticate to the RADIUS server?

With username and password. Or a certificate.

...

Basically I need to automate the current manual task of creating the user accounts on the WLAN.

You said you were going to make a Ruby application that will handle that.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Matthew Carriere matthew@blackninjasoftware.com

Ok. So if I used a ready made captive portal solution, would my solution still work? Captive Portal authenticates users (using FreeRadius?) WLAN controller delivers an IP. On Wed, Dec 10, 2008 at 2:38 AM, <tnt@kalik.net> wrote:

...

Yes I do plan on using a RoR application to make the changes to the MySQL database. So I think this is coming together. However, the username and password... where is the user responsible for using those credentials.

Would a user connect to my WiFi network, then authenticate against the RADIUS server using credentials obtained through a Ruby on Rails application?

Here's the workflow I am thinking to build this:

1. User connects to WiFi network. 2. User is directed to a Ruby on Rails application. 3. Application authorizes user to connect, creates credentials and propagates them to FreeRadius. 4. Application gives credentials to user. 5. User enters credentials (where?)

Oh, you are thinking of building a captive portal, not just something that will adminster users.

...

I need hotspot functionality so I am almost there in terms of everything I need to build. Are these points rational?

Probably not. How long do you think on spending on this? Months? Years?

...

Also, where are the credentials entered in #5?

If you are seriously thinking of making a captive portal (and not using ready made one) - you will have to make user interface too.

...

Wouldn't I just need to deliver an IP or something to that machine at that point?

Oh no. There is so much more to it than that.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Matthew Carriere matthew@blackninjasoftware.com

I have had a number of problems with 1.1.7 and sqlippool that its simply not able to process more than 10-20 connections at any one time. I will upgrade to 2.1.3 if its capable of handing 50-80 connections at one time? Does any one know? My server is a p4 dual core 3.0ghz and its also handing some load of emails for about 200 accounts. I tried to optimize my mysql installation, etc num_server but I could never get it fast enough. Anyone know of tricks, or if 2.1.3 freeradius is any better? or should I be looking at some other way to hand out IPs? I really like the sqlippool way of doing things. Thanks!