Hello, According to the doc https://wiki.freeradius.org/config/Proxy ......... * he remote server replies with ACK or REJECT * On ACK: The initial Auth-Type is set to Accept * On REJECT: The initial Auth-Type is set to Reject * Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL. ........... Waking up in 0.3 seconds. (0) Marking home server 217. port 1649 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 112 from NAS (0) Service-Type = Framed-User (0) Cisco-AVPair = "ip:vrf-id=BEXX" (0) Cisco-AVPair = "ip:ip-unnumbered=Loopback22" (0) Framed-IP-Netmask = 255.255.255.255 (0) Proxy-State = 0x3936 (0) Framed-IP-Address = ZZZ (0) Session-Timeout = 172800 (0) server dsl { (0) # Executing section post-proxy from file /etc/raddb/config/... (0) post-proxy { (0) post_proxy_log: --> Thu Nov 25 14:48:24 2021 (0) [post_proxy_log] = ok (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> BE (0) attr_filter.post-proxy: Matched entry DEFAULT at line 106 (0) [attr_filter.post-proxy] = updated (0) } # post-proxy = updated (0) } (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/config/ (0) post-auth { (0) if (&reply:Subscription-Name=="PRO"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&reply:Subscription-Name=="NOSERVICE"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) elsif (&reply:Subscription-Name != '') { (0) ERROR: Failed retrieving values required to evaluate condition (0) update reply { (0) Service-Type := Framed-User (0) Framed-IP-Netmask := 255.255.255.255 (0) } # update reply = noop (0) if (reply:Framed-IP-Address) { (0) if (reply:Framed-IP-Address) -> FALSE (0) else { (0) update reply { (0) Session-Timeout = 172800 (0) } # update reply = noop (0) } # else = noop (0) } # post-auth = noop (0) Login OK: [BCtest@BXXX] (from client test port 0) (0) Sent Access-Accept Id 96 from (0) Framed-IP-Netmask := 255.255.255.255 (0) Service-Type := Framed-User (0) Session-Timeout = 172800 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 96 with timestamp +8 Ready to process requests In users I have a match before the proxy (0) [suffix] = updated (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 54 (0) auth_dsl: users: Matched entry DEFAULT at line 79 (0) [auth_dsl] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop But this is not applied at all after the accept.... Any ideas ?
On Nov 25, 2021, at 8:55 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
Waking up in 0.3 seconds. (0) Marking home server 217. port 1649 alive (0) Clearing existing &reply: attributes ...
In users I have a match before the proxy ... But this is not applied at all after the accept....
See: "clearing existing reply attributes" The reply from the home server is taken as the *correct* reply to the NAS. If you want to add more attributes, do that in post-auth. Alan DeKok.
Hi Alan; In post auth is there a way to distinct local auth & proxy auth ? Thanks -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Alan DeKok Envoyé : jeudi 25 novembre 2021 15:28 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Proxy On Nov 25, 2021, at 8:55 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
Waking up in 0.3 seconds. (0) Marking home server 217. port 1649 alive (0) Clearing existing &reply: attributes ...
In users I have a match before the proxy ... But this is not applied at all after the accept....
See: "clearing existing reply attributes" The reply from the home server is taken as the *correct* reply to the NAS. If you want to add more attributes, do that in post-auth. Alan DeKok. - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7C3cf2ec8c9b4743d8b06508d9b01fc6b3%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734473237045338%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=BxxH%2BzG0uLXX2ocB7oo%2FbHtXfq3cbnvQsT1MVGv6lBM%3D&reserved=0
... (0) Proxy-State = 0x313036 (0) if ("&reply:Proxy-State" =~ /$/) { (0) if ("&reply:Proxy-State" =~ /$/) -> TRUE (0) if ("&reply:Proxy-State" =~ /$/) { Trying to expand Proxy-State but returns empty -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Alan DeKok Envoyé : jeudi 25 novembre 2021 15:57 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Proxy On Nov 25, 2021, at 9:48 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
In post auth is there a way to distinct local auth & proxy auth ?
If the request was proxied, there's a Proxy-To-Realm attribute, and the proxy / proxy_reply lists exist. Alan DeKok. - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7Cfd4962c40a6846b695c808d9b023d0c7%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734490141899660%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=cfKC7q2eFHfVBV7d1S8mjYbjPAbG2M4nUxGMy%2FX5nlw%3D&reserved=0
On Nov 25, 2021, at 10:22 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote: ... (0) Proxy-State = 0x313036 (0) if ("&reply:Proxy-State" =~ /$/) { (0) if ("&reply:Proxy-State" =~ /$/) -> TRUE (0) if ("&reply:Proxy-State" =~ /$/) {
Trying to expand Proxy-State but returns empty
You don't need to quote the attribute name. None of the documentation and examples do that. You don't need to check for non-empty values via a regular expression. You can just check if the attribute exists. See "man unlang" And even if that's fixed, you're looking at the *reply* list. The Proxy-State is in the *proxy* and *proxy_reply* list. Read the debug output to see this. So what you want is: if (&proxy:Proxy-State) { ... prequest was proxied } Alan DeKok.
I missed something ? /etc/raddb/config/Belcenter_DSL.conf[362]: Parse error in condition /etc/raddb/config/Belcenter_DSL.conf[362]: (&proxy:Proxy-State) { /etc/raddb/config/Belcenter_DSL.conf[362]: ^ Invalid list qualifier Errors reading or parsing /etc/raddb/radiusd.conf .......... if (&proxy_reply:Proxy-State) { ........... -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Alan DeKok Envoyé : jeudi 25 novembre 2021 16:33 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Proxy
On Nov 25, 2021, at 10:22 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote: ... (0) Proxy-State = 0x313036 (0) if ("&reply:Proxy-State" =~ /$/) { (0) if ("&reply:Proxy-State" =~ /$/) -> TRUE (0) if ("&reply:Proxy-State" =~ /$/) {
Trying to expand Proxy-State but returns empty
You don't need to quote the attribute name. None of the documentation and examples do that. You don't need to check for non-empty values via a regular expression. You can just check if the attribute exists. See "man unlang" And even if that's fixed, you're looking at the *reply* list. The Proxy-State is in the *proxy* and *proxy_reply* list. Read the debug output to see this. So what you want is: if (&proxy:Proxy-State) { ... prequest was proxied } Alan DeKok. - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7C0b74e0facd17477842b308d9b028dac5%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734511796509980%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=QhRNDkJXMBfQbZyTCYNRs4YNCiH%2BPpEWYZ0W6uVODkU%3D&reserved=0
On Nov 25, 2021, at 10:48 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
I missed something ?
/etc/raddb/config/Belcenter_DSL.conf[362]: Parse error in condition /etc/raddb/config/Belcenter_DSL.conf[362]: (&proxy:Proxy-State) { /etc/raddb/config/Belcenter_DSL.conf[362]: ^ Invalid list qualifier Errors reading or parsing /etc/raddb/radiusd.conf
Use if (&proxy-request:Proxy-State) { I'm using v3 less and less these days. This is all in "man unlang". Alan DeKok.
Thanks Alan. -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Alan DeKok Envoyé : jeudi 25 novembre 2021 17:06 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Proxy
On Nov 25, 2021, at 10:48 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
I missed something ?
/etc/raddb/config/Belcenter_DSL.conf[362]: Parse error in condition /etc/raddb/config/Belcenter_DSL.conf[362]: (&proxy:Proxy-State) { /etc/raddb/config/Belcenter_DSL.conf[362]: ^ Invalid list qualifier Errors reading or parsing /etc/raddb/radiusd.conf
Use if (&proxy-request:Proxy-State) { I'm using v3 less and less these days. This is all in "man unlang". Alan DeKok. - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7C7e43a7634f2c42d2413908d9b02d8fa3%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734532319461568%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=P8T5dyjGqbOEfuIgoIv%2F9Bl3z2CLmL78W8re5HMvX3U%3D&reserved=0
participants (2)
-
Alan DeKok -
Nicolas Breuer