How to set values of authentication quintuplets received in a REST response from the AuC
hi All, I'm trying to configure freeradius server to use REST to get EAP-AKA authentication vector. In fact, I'm sending a rest message to an HSS server which is generating the authentication vector and sending it back in JSON format to freeradius server in 200 OK message, here is an example of 200 OK message with json content: { "_AUTN": "c602e56f0c169001dc3ba3e2614ff0af", "_XRES":"90e7ae114d3a8578", "_RAND":"5090a3ea24f861004111fb71bb0bc05c", "_CK":"cc03c7d1cadd5a28a6717d67a2eb9cfb", "_IK":"2a6e7e1fa6716eba7d976204634c9992" } This is what I can see in the log file when the 200 OK is parsed: Processing response header (4,3) Status : 200 (OK) (4,3) Type : json (application/json) (4,3) rest - Resuming execution (4,3) rest - Updating result attribute(s) (4,3) rest - &request.REST-HTTP-Status-Code := 200 (4,3) rest - Parsing attribute "_AUTN" (4,3) rest - &reply:_AUTN := "c602e56f0c169001dc3ba3e2614ff0af" (4,3) rest - Parsing attribute "_XRES" (4,3) rest - &reply:_XRES := "90e7ae114d3a8578" (4,3) rest - Parsing attribute "_RAND" (4,3) rest - &reply:_RAND := "5090a3ea24f861004111fb71bb0bc05c" (4,3) rest - Parsing attribute "_CK" (4,3) rest - &reply:_CK := "cc03c7d1cadd5a28a6717d67a2eb9cfb" (4,3) rest - Parsing attribute "_IK" (4,3) rest - &reply:_IK := "2a6e7e1fa6716eba7d976204634c9992" (4,3) rest - Released connection (2) (4,3) rest (updated) In the eap-aka-sim module, I need to set the quintuplets (RAND, AUTN, CK, IK, XRES) received from the HSS but I don't know how can use the values received for each parameter? FYI, I used map function given in json module but I'm getting the following error when I start my freeradius server. here is what I tried in my json module: map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" { &AUTN := '$._AUTN' &CK := '$._CK' &IK := '$._IK' &RAND := '$._RAND' &XRES := '$._XRES' } in rest module, I have this configuration: connect_uri = "http://172.26.111.160:80" authorize { uri = "${..connect_uri}/rest/hss/wlan/getAuthenticationVector/%{User-Name}" method = 'POST' body = 'json' force_to = 'json' data = '{"username":"admin","password":"password","ratType":"WLAN","calledId":"%{Called-Station-ID}","callingId":"%{Calling-Station-ID}","nbOfVectors":1}' tls = ${..tls} } and this is the error I'm getting: Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2022 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/usr/local/etc/raddb/dictionary" including configuration file /usr/local/etc/raddb/radiusd.conf Including files in directory "/usr/local/etc/raddb/template.d/" including configuration file /usr/local/etc/raddb/template.d/default including configuration file /usr/local/etc/raddb/clients.conf Including files in directory "/usr/local/etc/raddb/mods-enabled/" including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/client including configuration file /usr/local/etc/raddb/mods-enabled/delay including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/eap_inner including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/escape including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/json /usr/local/etc/raddb/mods-enabled/json[75]: Parse error: expected '{', got text ""%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" {" Error reading or parsing /usr/local/etc/raddb/radiusd.conf Thanks in advance for your help, BRs, Amine
On Feb 10, 2022, at 11:06 AM, amine mustapha smaali <amine_mustapha@hotmail.com> wrote:
FYI, I used map function given in json module but I'm getting the following error when I start my freeradius server. here is what I tried in my json module:
map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" {
You don't put that into the json module. You put it into a processing section. i.e. something in sites-enabled/ Alan DeKok.
On Feb 11, 2022, at 9:41 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 10, 2022, at 11:06 AM, amine mustapha smaali <amine_mustapha@hotmail.com> wrote:
FYI, I used map function given in json module but I'm getting the following error when I start my freeradius server. here is what I tried in my json module:
map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" {
You don't put that into the json module. You put it into a processing section. i.e. something in sites-enabled/
i.e. send Challenge-Request { map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity)" { &AUTN := '$._AUTN' &CK := '$._CK' &IK := '$._IK' &RAND := '$._RAND' &XRES := '$._XRES' } } Note User-Name is the wrong attribute to use here, it's only the RADIUS User-Name and not available inside the eap-aka-sim virtual server. You want session-state.Permanent-Identity which id derived from the EAP Identity Response, or as the result of looking up/decoding/decrypting a pseudonym or fast reauth ID. -Arran
On Feb 11, 2022, at 12:59 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Feb 11, 2022, at 9:41 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 10, 2022, at 11:06 AM, amine mustapha smaali <amine_mustapha@hotmail.com> wrote:
FYI, I used map function given in json module but I'm getting the following error when I start my freeradius server. here is what I tried in my json module:
map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" {
You don't put that into the json module. You put it into a processing section. i.e. something in sites-enabled/
typo, should be map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity})" { Stupid fiddly brackets. -Arran
Dear Arran, Thanks a lot for your help. I've tried your suggestion and now my freeradius server is starting without any problem. However, the server is sending a rest message with Content-Type=application/x-www-form-urlencoded, I was expecting that the map function will only define the json parameters that will be parsed from the response message. In this case, I need a way to force the server to send a REST message with Content-Type=application/json and some json data {"key1":"value1","key2":"value2"}. Here is some output for your reference: Mon Feb 14 11:28:32 2022: (1.0) Sending HTTP POST to "http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/604020147863491\%40wlan.mnc002.mcc604.3gppnetwork.org" Mon Feb 14 11:28:32 2022: (1.0) Connect timeout is 3s, request timeout is 4s Mon Feb 14 11:28:32 2022: (1.0) Adding custom headers: Mon Feb 14 11:28:32 2022: (1.0) X-FreeRADIUS-Section: xlat Mon Feb 14 11:28:32 2022: (1.0) X-FreeRADIUS-Server: (null) Mon Feb 14 11:28:32 2022: (1.0) Request body content-type will be "application/x-www-form-urlencoded" Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "EAP-Identity" Mon Feb 14 11:28:32 2022: (1.0) Length : 51 Mon Feb 14 11:28:32 2022: (1.0) Value : 0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "EAP-Type" Mon Feb 14 11:28:32 2022: (1.0) Length : 3 Mon Feb 14 11:28:32 2022: (1.0) Value : AKA Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "Identity" Mon Feb 14 11:28:32 2022: (1.0) Length : 51 Mon Feb 14 11:28:32 2022: (1.0) Value : 0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "Identity-Type" Mon Feb 14 11:28:32 2022: (1.0) Length : 9 Mon Feb 14 11:28:32 2022: (1.0) Value : permanent Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "Method-Hint" Mon Feb 14 11:28:32 2022: (1.0) Length : 3 Mon Feb 14 11:28:32 2022: (1.0) Value : AKA Mon Feb 14 11:28:32 2022: (1.0) POST Data: EAP-Identity=0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org&EAP-Type=AKA&Identity=0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org&Identity-Type=permanent&Method-Hint=AKA Regards, Amine ________________________________ From: Freeradius-Users <freeradius-users-bounces+amine_mustapha=hotmail.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Friday, February 11, 2022 19:01 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: How to set values of authentication quintuplets received in a REST response from the AuC
On Feb 11, 2022, at 12:59 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Feb 11, 2022, at 9:41 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 10, 2022, at 11:06 AM, amine mustapha smaali <amine_mustapha@hotmail.com> wrote:
FYI, I used map function given in json module but I'm getting the following error when I start my freeradius server. here is what I tried in my json module:
map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" {
You don't put that into the json module. You put it into a processing section. i.e. something in sites-enabled/
typo, should be map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity})" { Stupid fiddly brackets. -Arran
Hi All, Just to update you with some solutions related to my topic. I was able to set the content-type to application/json and also was able to send json data, this the settings I did in eap-aka-sim site: send Challenge-Request { update control { &REST-HTTP-Header='Content-Type: application/json' } update request { &REST-HTTP-Body='{"username":"admin","password":"password","ratType":"WLAN","calledId":"%{Called-Station-ID}","callingId":"%{Calling-Station-ID}","nbOfVectors":1}' } map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity} %{request.REST-HTTP-Body})" { &SIM-AUTN := '$._AUTN' &SIM-CK := '$._CK' &SIM-IK := '$._IK' &SIM-RAND := '$._RAND' &SIM-XRES := '$._XRES' } update control { &RAND = &SIM-RAND &AUTN = &SIM-AUTN &CK = &SIM-CK &IK = &SIM-IK &XRES = &SIM-XRES } ok } Now I'm struggling to find a solution for the following issues: * How can I send the %{Calling-Station-ID} parameter in json data from eap-aka-sim site * How can I convert the string data I received in 200 OK to hex value (e.g _RAND="11111111111111111111111111111111" to RAND=0x11111111111111111111111111111111) Regards, Amine Regards, Amine ________________________________ From: amine mustapha smaali <amine_mustapha@hotmail.com> Sent: Monday, February 14, 2022 11:38 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: How to set values of authentication quintuplets received in a REST response from the AuC Dear Arran, Thanks a lot for your help. I've tried your suggestion and now my freeradius server is starting without any problem. However, the server is sending a rest message with Content-Type=application/x-www-form-urlencoded, I was expecting that the map function will only define the json parameters that will be parsed from the response message. In this case, I need a way to force the server to send a REST message with Content-Type=application/json and some json data {"key1":"value1","key2":"value2"}. Here is some output for your reference: Mon Feb 14 11:28:32 2022: (1.0) Sending HTTP POST to "http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/604020147863491\%40wlan.mnc002.mcc604.3gppnetwork.org" Mon Feb 14 11:28:32 2022: (1.0) Connect timeout is 3s, request timeout is 4s Mon Feb 14 11:28:32 2022: (1.0) Adding custom headers: Mon Feb 14 11:28:32 2022: (1.0) X-FreeRADIUS-Section: xlat Mon Feb 14 11:28:32 2022: (1.0) X-FreeRADIUS-Server: (null) Mon Feb 14 11:28:32 2022: (1.0) Request body content-type will be "application/x-www-form-urlencoded" Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "EAP-Identity" Mon Feb 14 11:28:32 2022: (1.0) Length : 51 Mon Feb 14 11:28:32 2022: (1.0) Value : 0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "EAP-Type" Mon Feb 14 11:28:32 2022: (1.0) Length : 3 Mon Feb 14 11:28:32 2022: (1.0) Value : AKA Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "Identity" Mon Feb 14 11:28:32 2022: (1.0) Length : 51 Mon Feb 14 11:28:32 2022: (1.0) Value : 0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "Identity-Type" Mon Feb 14 11:28:32 2022: (1.0) Length : 9 Mon Feb 14 11:28:32 2022: (1.0) Value : permanent Mon Feb 14 11:28:32 2022: (1.0) Encoding attribute "Method-Hint" Mon Feb 14 11:28:32 2022: (1.0) Length : 3 Mon Feb 14 11:28:32 2022: (1.0) Value : AKA Mon Feb 14 11:28:32 2022: (1.0) POST Data: EAP-Identity=0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org&EAP-Type=AKA&Identity=0604020147863491%40wlan.mnc002.mcc604.3gppnetwork.org&Identity-Type=permanent&Method-Hint=AKA Regards, Amine ________________________________ From: Freeradius-Users <freeradius-users-bounces+amine_mustapha=hotmail.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Friday, February 11, 2022 19:01 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: How to set values of authentication quintuplets received in a REST response from the AuC
On Feb 11, 2022, at 12:59 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Feb 11, 2022, at 9:41 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 10, 2022, at 11:06 AM, amine mustapha smaali <amine_mustapha@hotmail.com> wrote:
FYI, I used map function given in json module but I'm getting the following error when I start my freeradius server. here is what I tried in my json module:
map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{User-Name})" {
You don't put that into the json module. You put it into a processing section. i.e. something in sites-enabled/
typo, should be map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity})" { Stupid fiddly brackets. -Arran
Now I'm struggling to find a solution for the following issues:
* How can I send the %{Calling-Station-ID} parameter in json data from eap-aka-sim site
Sorry master is still under development, using foreign attributes in a nested request doesn't work well yet. For now, at the top of the recv Access-Request section of the default virtual server add: update request { &Tmp-String-0 := &Calling-Station-ID &Tmp-String-1 := &Called-Station-ID } Then in your rest expansion you can access Calling-Station-ID with %{outer.Tmp-String-0}, and Called-Station-Id with %{outer.Tmp-String-1}.
* How can I convert the string data I received in 200 OK to hex value (e.g _RAND="11111111111111111111111111111111" to RAND=0x11111111111111111111111111111111)
In your original example you omitted control, and I omitted it in mine, but it is required for the code to work. For converting hex to bin (which is what I'm assuming you want despite asking for the opposite) assign _RAND to Tmp-String-0 or another temporary attribute, and then after the map section: send Challenge-Request { map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity)" { &control.AUTN := '$._AUTN' &control.CK := '$._CK' &control.IK := '$._IK' &control.XRES := '$._XRES' &control.Tmp-String-0 := '$._RAND' } update control { &RAND := %{bin:%{Tmp-String-0}} } } -Arran
Hi Arran, Thanks a lot for your great support. Your proposal worked for me. Thanks again and BRs, Amine ________________________________ From: Freeradius-Users <freeradius-users-bounces+amine_mustapha=hotmail.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Tuesday, February 15, 2022 01:26 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: How to set values of authentication quintuplets received in a REST response from the AuC
Now I'm struggling to find a solution for the following issues:
* How can I send the %{Calling-Station-ID} parameter in json data from eap-aka-sim site
Sorry master is still under development, using foreign attributes in a nested request doesn't work well yet. For now, at the top of the recv Access-Request section of the default virtual server add: update request { &Tmp-String-0 := &Calling-Station-ID &Tmp-String-1 := &Called-Station-ID } Then in your rest expansion you can access Calling-Station-ID with %{outer.Tmp-String-0}, and Called-Station-Id with %{outer.Tmp-String-1}.
* How can I convert the string data I received in 200 OK to hex value (e.g _RAND="11111111111111111111111111111111" to RAND=0x11111111111111111111111111111111)
In your original example you omitted control, and I omitted it in mine, but it is required for the code to work. For converting hex to bin (which is what I'm assuming you want despite asking for the opposite) assign _RAND to Tmp-String-0 or another temporary attribute, and then after the map section: send Challenge-Request { map json "%(rest:POST http://172.26.111.160/rest/hss/wlan/getAuthenticationVector/%{session-state.Permanent-Identity)" { &control.AUTN := '$._AUTN' &control.CK := '$._CK' &control.IK := '$._IK' &control.XRES := '$._XRES' &control.Tmp-String-0 := '$._RAND' } update control { &RAND := %{bin:%{Tmp-String-0}} } } -Arran
participants (3)
-
Alan DeKok -
amine mustapha smaali -
Arran Cudbard-Bell