freeradius and the current date
Hi all, I am looking to perform an LDAP search in freeradius that includes the option to specify users that have not expired, where expiry is contained an a standard LDAP attribute. Something similar to this: (&(uid=%{User-Name})(myExpiryTimestamp>=%{[TIMESTAMP_NOW]})) (In other words, I am looking for a suitable unlang attribute that represents “time now on radius server”) The closest I’ve found are these deprecated one character variables as follows: http://wiki.freeradius.org/config/Run%20time%20variables Unfortunately they are marked as deprecated with no indication of what replaces them. The source code for rlm_date seems to indicate that date formatting is possible, but there is no functionality that I can see to provide the current date, which is a shame. Should this module be a good place for this kind of functionality or should I be looking somewhere else for this? Regards, Graham —
On 5 Mar 2015, at 09:56, Graham Leggett <minfrin@sharp.fm> wrote:
Hi all,
I am looking to perform an LDAP search in freeradius that includes the option to specify users that have not expired, where expiry is contained an a standard LDAP attribute. Something similar to this:
(&(uid=%{User-Name})(myExpiryTimestamp>=%{[TIMESTAMP_NOW]}))
(In other words, I am looking for a suitable unlang attribute that represents “time now on radius server”)
The closest I’ve found are these deprecated one character variables as follows:
http://wiki.freeradius.org/config/Run%20time%20variables
Unfortunately they are marked as deprecated with no indication of what replaces them.
The source code for rlm_date seems to indicate that date formatting is possible, but there is no functionality that I can see to provide the current date, which is a shame. Should this module be a good place for this kind of functionality or should I be looking somewhere else for this?
Call rlm_preprocess which will give you Event-Timestamp. # # Create or parse an ASN1 generalized time stamp # # Note: Not as flexible as it should be due to fixed strftime format # # Should be able to deal with fractional seconds and lack of timezone. # date generalized_time { format = "%Y%m%d%H%M%S%z" } (&(uid=%{User-Name})(myExpiryTimestamp>=%{generalized_time:&Event-Timestamp})) the rlm_date and Event-Timestamp combo replace the one letter expansions. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 05 Mar 2015, at 5:25 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Call rlm_preprocess which will give you Event-Timestamp.
# # Create or parse an ASN1 generalized time stamp # # Note: Not as flexible as it should be due to fixed strftime format # # Should be able to deal with fractional seconds and lack of timezone. # date generalized_time { format = "%Y%m%d%H%M%S%z" }
(&(uid=%{User-Name})(myExpiryTimestamp>=%{generalized_time:&Event-Timestamp}))
the rlm_date and Event-Timestamp combo replace the one letter expansions.
Thanks for confirming this. Does Event-Timestamp represent the date on the radius server itself, or the date as provided by the NAS in the request? Regards, Graham —
On 05 Mar 2015, at 5:56 PM, Alan DeKok <aland@deployingradius.com> wrote:
Event-Timestamp is provided by the NAS. It can be *anything*.
Does an attribute exist that represents the time on the radius server? (In my case I can’t trust the NAS). If not I’m happy to submit a patch. Regards, Graham —
On 5 Mar 2015, at 11:00, Graham Leggett <minfrin@sharp.fm> wrote:
On 05 Mar 2015, at 5:56 PM, Alan DeKok <aland@deployingradius.com> wrote:
Event-Timestamp is provided by the NAS. It can be *anything*.
Does an attribute exist that represents the time on the radius server? (In my case I can’t trust the NAS). If not I’m happy to submit a patch.
Event-Timestamp is added by rlm_preprocess if it doesn't already exist in the request. NAS don't send Event-Timestamp in Access-Requests so it will always be the time on the server the request was received. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Mar 5, 2015, at 11:00 AM, Graham Leggett <minfrin@sharp.fm> wrote:
On 05 Mar 2015, at 5:56 PM, Alan DeKok <aland@deployingradius.com> wrote:
Event-Timestamp is provided by the NAS. It can be *anything*.
Does an attribute exist that represents the time on the radius server? (In my case I can’t trust the NAS). If not I’m happy to submit a patch.
Yes. http://wiki.freeradius.org/config/Run%20time%20variables There are a number. Choose year, month, day, etc. Alan DeKok.
(&(uid=%{User-Name})(myExpiryTimestamp>=%{generalized_time:&Event-Timestamp})) the rlm_date and Event-Timestamp combo replace the one letter expansions.
Ahhh, brilliant... now I know how it works :-) Thanks, Arran! :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Graham Leggett -
Stefan Paetow