multiple realm proxying based on huntgroup.
I appoligize if this question is covered somewhere, in docuementation, but I haven't found it. If you can point me to I would greatly appreciate it. I am trying to figure out a way to have different groups of realm proxies for different NAS/huntgroups. For example, for a VPN resouces I don't want realms, but for wireless/wired 802.1x I want to be able to forward to other realms. I would like to do this without running multiple instances of radiusd. I have been able to do this with Merit's AAA server for a long time, but it doesn't support kerberos v5 authentication, nor 802.1x currently. Thanks, -Roy -- /********************************************************************/ /* Roy Hockett * Telephone: (734) 763-7325 */ /* Network Engineer, * FAX: (734) 615-1727 */ /* ITCom, * Internet: royboy@umich.edu */ /* University of Michigan * */ /********************************************************************/
Roy D. Hockett wrote:
I am trying to figure out a way to have different groups of realm proxies for different NAS/huntgroups. For example, for a VPN resouces I don't want realms, but for wireless/wired 802.1x I want to be able to forward to other realms.
In the "users" file: DEFAULT Huntgroup-Name == wireless, Proxy-To-Realm := other.com -- Nicolas Baradakis
Roy D. Hockett wrote:
I am trying to figure out a way to have different groups of realm proxies for different NAS/huntgroups. For example, for a VPN resouces I don't want realms, but for wireless/wired 802.1x I want to be able to forward to other realms.
In the "users" file:
DEFAULT Huntgroup-Name == wireless, Proxy-To-Realm := other.com
I don't understand your response. Are you saying on a per users basis set this?
Please read the users(5) manpage. The keyword "DEFAULT" matches any usernames. In this case it's the "Huntgroup-Name" variable which is used to match the incoming request. DEFAULT Huntgroup-Name == wired, Proxy-To-Realm := realm1.net DEFAULT Huntgroup-Name == wireless, Proxy-To-Realm := realm2.com The hungroups have to be defined in /etc/raddb/huntgroups and the realm servers in /etc/raddb/proxy.conf. Nicolas Baradakis -- A: Yes.
Q: Are you sure?
A: Because it reverses the logical flow of conversation.
Q: Why is top posting annoying in email?
participants (2)
-
Nicolas Baradakis -
Roy D. Hockett