Hi everybody ! I've configured freeradius with an ldap backend. I had to create new attributes that are sent correctly in the reply. But when i try to put these attributes in the "update coa", the value of these variable are empty. I've tried the syntax %<reply>Attribute-Name but it's still empty. Here the debug output if someone can give me a hint : ... adding new socket proxy address * port 54865 ... adding new socket proxy address * port 44764 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 43501, id=62, length=93 User-Name = "testuser" User-Password = "mypasswd" NAS-IP-Address = 172.20.13.27 NAS-Port = 0 Framed-IP-Address = 192.168.1.5 Acct-Session-Id = "539848" Message-Authenticator = 0x92985a75e680a1d422ceb47ba117ea62 # Executing section authorize from file /etc/freeradius/sites-enabled/wol +- entering group authorize {...} ++[preprocess] returns ok [chocoldap] performing user authorization for testuser [chocoldap] expand: %{Stripped-User-Name} -> [chocoldap] ... expanding second conditional [chocoldap] expand: %{User-Name} -> testuser [chocoldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [chocoldap] expand: ou=wol,dc=labingesys,dc=lan -> ou=wol,dc=labingesys,dc=lan [chocoldap] ldap_get_conn: Checking Id: 0 [chocoldap] ldap_get_conn: Got Id: 0 [chocoldap] attempting LDAP reconnection [chocoldap] (re)connect to 172.20.13.25:389, authentication 0 [chocoldap] bind as cn=admin,dc=labingesys,dc=lan/chocolab to 172.20.13.25:389 [chocoldap] waiting for bind result ... [chocoldap] Bind was successful [chocoldap] performing search in ou=wol,dc=labingesys,dc=lan, with filter (uid=testuser) [chocoldap] checking if remote access for testuser is allowed by uid [chocoldap] Added User-Password = mypasswd in check items [chocoldap] No default NMAS login sequence [chocoldap] looking for check items in directory... [chocoldap] userPassword -> Password-With-Header == "mypasswd" [chocoldap] looking for reply items in directory... [chocoldap] AlcSLAProfStr -> Alc-SLA-Prof-Str = "sla-profile2" [chocoldap] AlcSubscProfStr -> Alc-Subsc-Prof-Str = "sub-profile1" [chocoldap] user testuser authorized to use remote access [chocoldap] ldap_release_conn: Release Id: 0 ++[chocoldap] returns ok ++[chap] returns noop [pap] Config already contains "known good" password. Ignoring Password-With-Header ++[pap] returns updated expand: %{User-Name} -> testuser expand: %{Acct-Session-Id} -> 539848 expand: %{NAS-IP-Address} -> 172.20.13.27 expand: %{Framed-IP-Address} -> 192.168.1.5 expand: %{Alc-Subsc-Prof-Str#} -> expand: %{Alc-SLA-Prof-Str} -> ++[coa] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/wol +- entering group PAP {...} [pap] login attempt with password "mypasswd" [pap] Using clear text password "mypasswd" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/wol +- entering group post-auth {...} ++[chocoldap] returns noop Sending Access-Accept of id 62 to 127.0.0.1 port 43501 Alc-SLA-Prof-Str = "sla-profile2" Alc-Subsc-Prof-Str = "sub-profile1" # Executing section pre-proxy from file /etc/freeradius/sites-enabled/wol +- entering group pre-proxy {...} [pre_proxy_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/pre-proxy-detail-20120829 [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/pre-proxy-detail-20120829 [pre_proxy_log] expand: %t -> Wed Aug 29 14:12:29 2012 ++[pre_proxy_log] returns ok Sending CoA-Request of id 238 to 80.236.127.146 port 3799 User-Name = "testuser" Acct-Session-Id = "539848" NAS-IP-Address = 172.20.13.27 Framed-IP-Address = 192.168.1.5 Alc-Subsc-Prof-Str = "" Alc-SLA-Prof-Str = "" Finished request 0. Going to the next request Waking up in 1.9 seconds. Sending CoA-Request of id 238 to 80.236.127.146 port 3799 User-Name = "testuser" Acct-Session-Id = "539848" NAS-IP-Address = 172.20.13.27 Framed-IP-Address = 192.168.1.5 Alc-Subsc-Prof-Str = "" Alc-SLA-Prof-Str = "" Waking up in 3.0 seconds. Cleaning up request 0 ID 62 with timestamp +9 Waking up in 0.7 seconds. Sending CoA-Request of id 238 to 80.236.127.146 port 3799 User-Name = "testuser" Acct-Session-Id = "539848" NAS-IP-Address = 172.20.13.27 Framed-IP-Address = 192.168.1.5 Alc-Subsc-Prof-Str = "" Alc-SLA-Prof-Str = "" Waking up in 7.6 seconds Thanks
On Wed, Aug 29, 2012 at 9:54 PM, Chocoflex Mamba <burvinch@gmail.com> wrote:
tried the syntax %<reply>Attribute-Name but it's still empty.
Of course it's empty. The syntax is wrong. Where did you read that? Or is it a typo?
[chocoldap] looking for reply items in directory... [chocoldap] AlcSLAProfStr -> Alc-SLA-Prof-Str = "sla-profile2" [chocoldap] AlcSubscProfStr -> Alc-Subsc-Prof-Str = "sub-profile1"
so those are reply attributes?
expand: %{Alc-Subsc-Prof-Str#} -> expand: %{Alc-SLA-Prof-Str} ->
Try %{reply:Alc-Subsc-Prof-Str#} %{reply:Alc-SLA-Prof-Str} See http://freeradius.org/radiusd/man/unlang.html for details. -- Fajar
It's not a typo, it's just the format in unlang documentation: "Attribute lists may be referenced via the following syntax " %{<list>:Attribute-Name} This is what i have in my update coa : update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Alc-Subsc-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" Alc-SLA-Prof-Str = "%{reply:Alc-SLA-Prof-Str}" } and this is the result with debug : Sending Access-Accept of id 15 to 127.0.0.1 port 55966 Alc-SLA-Prof-Str = "sla-profile2" Alc-Subsc-Prof-Str = "sub-profile1" WARNING: Empty pre-proxy section. Using default return values. Sending CoA-Request of id 165 to 80.236.127.146 port 3799 User-Name = "chocouser" Acct-Session-Id = "539848" NAS-IP-Address = 172.20.13.27 Framed-IP-Address = 192.168.1.5 Alc-Subsc-Prof-Str = "" Alc-SLA-Prof-Str = "" On Wed, Aug 29, 2012 at 5:03 PM, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Aug 29, 2012 at 9:54 PM, Chocoflex Mamba <burvinch@gmail.com> wrote:
tried the syntax %<reply>Attribute-Name but it's still empty.
Of course it's empty. The syntax is wrong. Where did you read that? Or is it a typo?
[chocoldap] looking for reply items in directory... [chocoldap] AlcSLAProfStr -> Alc-SLA-Prof-Str = "sla-profile2" [chocoldap] AlcSubscProfStr -> Alc-Subsc-Prof-Str = "sub-profile1"
so those are reply attributes?
expand: %{Alc-Subsc-Prof-Str#} -> expand: %{Alc-SLA-Prof-Str} ->
Try
%{reply:Alc-Subsc-Prof-Str#} %{reply:Alc-SLA-Prof-Str}
See http://freeradius.org/radiusd/man/unlang.html for details.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Chocoflex Mamba wrote:
It's not a typo, it's just the format in unlang documentation:
"Attribute lists may be referenced via the following syntax
" %{<list>:Attribute-Name}
Don't be ridiculous. There's no attribute named "Attribute-Name". Some amount of independent thought is required.
This is what i have in my update coa :
update coa { ... Alc-Subsc-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" Alc-SLA-Prof-Str = "%{reply:Alc-SLA-Prof-Str}" }
and this is the result with debug : ... Alc-Subsc-Prof-Str = "" Alc-SLA-Prof-Str = ""
If you read the REST of the debug log, you'll see the it printing out the expansion. hint: if reply:Alc-Subsc-Prof-Str doesn't exist, the expansion results in an empty string. Alan DeKok.
I dit not write "%{<list>:Attribute-Name}" in my conf file. What i've understood from the document is that i can write for example : %{request:User-Name} %{reply:Alc-Subsc-Prof-Str} => i have this information in the reply(see below) And like i said in my previous post, that's what i wrote in my conf file. Below my update coa section : update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Alc-Subsc-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" Alc-SLA-Prof-Str = "%{reply:Alc-SLA-Prof-Str}" } In the debug you can see the access-accept with the right value for 2 the attributes : Wed Aug 29 18:51:21 2012 : Info: ++[chocoldap] returns noop Sending Access-Accept of id 193 to 127.0.0.1 port 42032 Alc-SLA-Prof-Str = "sla-profile2" Alc-Subsc-Prof-Str = "sub-profile1" Wed Aug 29 18:51:21 2012 : Info: # Executing section pre-proxy from file /etc/freeradius/sites-enabled/wol Wed Aug 29 18:51:21 2012 : Info: +- entering group pre-proxy {...} Wed Aug 29 18:51:21 2012 : Info: expand: %{User-Name} -> chocouser Wed Aug 29 18:51:21 2012 : Info: expand: %{Acct-Session-Id} -> 539848 Wed Aug 29 18:51:21 2012 : Info: expand: %{NAS-IP-Address} -> 172.20.13.27 Wed Aug 29 18:51:21 2012 : Info: expand: %{Framed-IP-Address} -> 192.168.1.5 Wed Aug 29 18:51:21 2012 : Info: expand: %{Alc-Subsc-Prof-Str} -> Wed Aug 29 18:51:21 2012 : Info: expand: %{Alc-SLA-Prof-Str} -> On Wed, Aug 29, 2012 at 6:26 PM, Alan DeKok <aland@deployingradius.com>wrote:
Chocoflex Mamba wrote:
It's not a typo, it's just the format in unlang documentation:
"Attribute lists may be referenced via the following syntax
" %{<list>:Attribute-Name}
Don't be ridiculous. There's no attribute named "Attribute-Name". Some amount of independent thought is required.
This is what i have in my update coa :
update coa { ... Alc-Subsc-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" Alc-SLA-Prof-Str = "%{reply:Alc-SLA-Prof-Str}" }
and this is the result with debug : ... Alc-Subsc-Prof-Str = "" Alc-SLA-Prof-Str = ""
If you read the REST of the debug log, you'll see the it printing out the expansion.
hint: if reply:Alc-Subsc-Prof-Str doesn't exist, the expansion results in an empty string.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 29/08/12 17:53, Chocoflex Mamba wrote:
file. Below my update coa section :
update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Alc-Subsc-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" Alc-SLA-Prof-Str = "%{reply:Alc-SLA-Prof-Str}"
Ok, you say you have reply:Var but the debug says:
Wed Aug 29 18:51:21 2012 : Info: expand: %{Alc-Subsc-Prof-Str} -> Wed Aug 29 18:51:21 2012 : Info: expand: %{Alc-SLA-Prof-Str} ->
Note: no "reply:". Are you editing the right file? Have you restarted the server?
Yes i was editing the right file but i've found strange characters in the file. I did some cleaning. Now, the update coa is sending every attributes correctly. It seems that i only have the expand ok in the section where i did configure the "update coa" (not ok in pre-proxy), see below : rad_recv: Access-Request packet from host 127.0.0.1 port 45089, id=44, length=88 User-Name = "rija" User-Password = "casper34" NAS-IP-Address = 172.20.13.41 NAS-Port = 0 Framed-IP-Address = 192.168.1.5 Acct-Session-Id = "539848" Message-Authenticator = 0x56316e653df7c0dee4ca4d51eb9605fb [chocoldap] looking for reply items in directory... [chocoldap] AlcSLAProfStr -> Alc-SLA-Prof-Str = "sla-profile1" [chocoldap] AlcSubscProfStr -> Alc-Subsc-Prof-Str = "sub-profile1" [chocoldap] user rija authorized to use remote access [chocoldap] ldap_release_conn: Release Id: 0 ++[chocoldap] returns ok ++[chap] returns noop [pap] Config already contains "known good" password. Ignoring Password-With-Header ++[pap] returns updated ++[expiration] returns noop ++[logintime] returns noop expand: %{User-Name} -> rija expand: %{Acct-Session-Id} -> 539848 expand: %{NAS-IP-Address} -> 172.20.13.41 expand: %{Framed-IP-Address} -> 192.168.1.5 expand: %{reply:Alc-Subsc-Prof-Str} -> sub-profile1 expand: %{reply:Alc-SLA-Prof-Str} -> sla-profile1 ++[coa] returns noop Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/wol +- entering group PAP {...} [pap] login attempt with password "casper34" [pap] Using clear text password "casper34" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/wol +- entering group post-auth {...} ++[chocoldap] returns noop Sending Access-Accept of id 44 to 127.0.0.1 port 45089 Alc-SLA-Prof-Str = "sla-profile1" Alc-Subsc-Prof-Str = "sub-profile1" # Executing section pre-proxy from file /etc/freeradius/sites-enabled/wol +- entering group pre-proxy {...} expand: %{User-Name} -> rija expand: %{Acct-Session-Id} -> 539848 expand: %{NAS-IP-Address} -> 172.20.13.41 expand: %{Framed-IP-Address} -> 192.168.1.5 expand: %{Alc-Subsc-Prof-Str} -> expand: %{Alc-SLA-Prof-Str} -> ++[coa] returns noop Sending CoA-Request of id 97 to 80.236.127.146 port 3799 User-Name = "rija" Acct-Session-Id = "539848" NAS-IP-Address = 172.20.13.41 Framed-IP-Address = 192.168.1.5 Alc-Subsc-Prof-Str = "sub-profile1" Alc-SLA-Prof-Str = "sla-profile1" Finished request 1. Thanks for your help On Wed, Aug 29, 2012 at 7:06 PM, Phil Mayers <p.mayers@imperial.ac.uk>wrote:
On 29/08/12 17:53, Chocoflex Mamba wrote:
file. Below my update coa section :
update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Alc-Subsc-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" Alc-SLA-Prof-Str = "%{reply:Alc-SLA-Prof-Str}"
Ok, you say you have reply:Var but the debug says:
Wed Aug 29 18:51:21 2012 : Info: expand: %{Alc-Subsc-Prof-Str} ->
Wed Aug 29 18:51:21 2012 : Info: expand: %{Alc-SLA-Prof-Str} ->
Note: no "reply:".
Are you editing the right file? Have you restarted the server?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
participants (4)
-
Alan DeKok -
Chocoflex Mamba -
Fajar A. Nugraha -
Phil Mayers