Forging a RADIUS request within a module
Hi all, During authentication process, I need to send an Accounting-Start to a network equipment when the authentication is successful (when processing the Access-Request), before sending the Access-Accept back. Is it possible to create the Accounting-Request from inside a module and "post it" as an event, to let FreeRADIUS core manage processing/sending? If not, I will have to trigger an external radiusclient to do the job. Thanks for your answers. Geoff.
During authentication process, I need to send an Accounting-Start to a network equipment
Just out of interest - what is "network equipment" going to do with the accounting request?
It's a network filtering appliance. The Accounting-Request ships attributes that say which filtering policy must be applied to the user traffic. Geoff.
On Fri, Dec 12, 2008 at 7:45 AM, Geoffroy ARNOUD <geo.arnoud@gmail.com>wrote:
During authentication process, I need to send an Accounting-Start to a network equipment
Just out of interest - what is "network equipment" going to do with the accounting request?
It's a network filtering appliance. The Accounting-Request ships attributes that say which filtering policy must be applied to the user traffic.
And these attributes can't be sent in the access-accept?
During authentication process, I need to send an Accounting-Start to a network equipment
Just out of interest - what is "network equipment" going to do with the accounting request?
It's a network filtering appliance. The Accounting-Request ships attributes that say which filtering policy must be applied to the user traffic.
And you are absolutely sure that you are supposed to send it an Accounting-Request and not proxy Access-Request? Considering that filtering policies are a part of the access setup that would make much more sense. Ivan Kalik Kalik Informatika ISP
And you are absolutely sure that you are supposed to send it an Accounting-Request and not proxy Access-Request? Considering that filtering policies are a part of the access setup that would make much more sense.
Yes I am. Actually, the appliance works like this, and is not the same box as the NAS. We are already connected to it and we use radclient to send the accounting-request to it. But as a migration from FreeRADIUS 1.1.3 towards 2.1.x may occur, I take a look whether the behaviour could be changed or not. Geoff.
Geoffroy Arnoud wrote:
Is it possible to create the Accounting-Request from inside a module and "post it" as an event, to let FreeRADIUS core manage processing/sending?
Yes. See src/main/session.c, session_zap() for a function that does this. But if you plan on sending a packet to another box, the best approach is to use radclient. Posting "internal" packets that get forwarded off of the box is likely not to work. Alan DeKok.
participants (5)
-
Alan DeKok -
Geoffroy Arnoud -
Geoffroy ARNOUD -
Stephen Bowman -
tnt＠kalik.net