Q: Define realms per virtual server.
Greetings, I'm hitting a situation where I would like to be able to define different realms in my virtual servers. Simply including realm definitions inside of the virtual servers doesn't work. It doesn't generate an error either, but the defined realm doesn't work. server internal { realm DEFAULT { authhost = remote1.com accthost = remote1.com nostrip } listen { ipaddr = * port = 1814 type = auth } listen { ipaddr = * port = 1815 type = acct } . . . } The 'realm' keyword is overloaded, being used both for the definitions of the delimiters and of the realms themselves. And while the former is loaded via a module syntax and can be loaded per-virtual-server (via suffix, ipass, etc.) I can't find any way to restrict the actual realm definitions to a virtual server. They are all global configuration loaded via proxy.conf. Is there some method I'm missing for making the realm definitions per-server? Thanks in advance, -David Mitchell ----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
David Mitchell wrote:
I'm hitting a situation where I would like to be able to define different realms in my virtual servers. Simply including realm definitions inside of the virtual servers doesn't work. It doesn't generate an error either, but the defined realm doesn't work.
You can't just invent a configuration and have it work. The "proxy.conf" file describes where realms are defined. They work there, and nowhere else.
The 'realm' keyword is overloaded, being used both for the definitions of the delimiters and of the realms themselves.
No.
And while the former is loaded via a module syntax and can be loaded per-virtual-server (via suffix, ipass, etc.)
That's like saying the "SQL" module implements an SQL database, because it's called "SQL". No, it doesn't work like that. The realm definition is in proxy.conf. The "realm" module uses the realm definitions to process packets which contain realms.
I can't find any way to restrict the actual realm definitions to a virtual server. They are all global configuration loaded via proxy.conf.
They are global.
Is there some method I'm missing for making the realm definitions per-server? Thanks in advance,
Source code modifications. Alan DeKok.
On Jun 10, 2013, at 3:58 PM, Alan DeKok <aland@deployingradius.com> wrote:
I can't find any way to restrict the actual realm definitions to a virtual server. They are all global configuration loaded via proxy.conf.
They are global.
That's what I suspected. Thanks for confirming. In my case I have two virtual servers, one which handles a local staff SSID and one which handles our eduroam SSID. Defining a NULL domain for the local SSID virtual server has the unfortunate effect of allowing a NULL domain for eduroam virtual server as well. I was able to achieve most of what I wanted by adding more checks in the virtual server authorize section of the eduroam server to double check for a NULL domain and force a reject.
Is there some method I'm missing for making the realm definitions per-server? Thanks in advance,
Source code modifications.
Always an option, but not necessarily the easiest. Thanks for the help, -David Mitchell
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
----------------------------------------------------------------- | David Mitchell (mitchell@ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------
participants (2)
-
Alan DeKok -
David Mitchell