RadGraph - a tool to return VLAN ID and Class attributes based on Entra Groups
Hi all, First, I have to say THANK-YOU to the whole FreeRADIUS team. I love this product!! :) I hope this is an appropriate place to share this! I’ve been using FreeRADIUS with great success for the past 6 months to do wired and wireless auth for the school network I managed. We’re a Microsoft 365 house, and I’m trying to deprecate on-prem NPS, hence the move to FreeRADIUS. We’re using EAP-TLS with user certs issued via Intune (from an on-prem NDES for now, hopefully sth else soon!). Because I need users dropped into different VLANs during the Wi-Fi auth, and to also supply RADIUS “Class” attributes to my Fortigate for RSSO based internet filtering, I built a ‘plugin’ solution for FreeRADIUS that uses the “exec” module to run a lookup during auth. I thought I’d share it here in case it’s useful to others! https://github.com/johnclearyconsulting/radgraph Thanks again, John -- John Cleary Melbourne, Australia +61 417 143 312 john@cleary.au
hi, an interesting approach. however, exec is very slow and you're firing up a powershell with a thing having to set-up calls etc) . I wonder if you'd be better off having a local process running that has already done all the handshake and then its just a local socket connection to make/query etc - or if the performance would be much higher using the python module (should be relatively easy if the required modules are around) - I don't have half the kit lying around to be able to test/dev this - otherwise would like to help on this :) regards alan
Microsoft Graph has REST API. I imagine one could use rlm_rest module for that instead of (slow) exec? On 4/23/26 18:28, Alan Buxey wrote:
hi,
an interesting approach. however, exec is very slow and you're firing up a powershell with a thing having to set-up calls etc) . I wonder if you'd be better off having a local process running that has already done all the handshake and then its just a local socket connection to make/query etc - or if the performance would be much higher using the python module (should be relatively easy if the required modules are around) - I don't have half the kit lying around to be able to test/dev this - otherwise would like to help on this :)
regards
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, 6 May 2026, at 21:54, Igor Smitran via Freeradius-Users wrote:
Microsoft Graph has REST API.
I imagine one could use rlm_rest module for that instead of (slow) exec?
When I last looked it was not straight forward for a number of reasons: https://github.com/jimdigriz/freeradius-oauth2-perl/blob/master/README.rlm_r... You might be able to skip paging support, assuming your users are not members of >999 groups, but it is was pretty hairy. Cheers
participants (4)
-
Alan Buxey -
Alexander Clouter -
Igor Smitran -
John Cleary