Re: Updating Multipe variables with one SQL Query
HI Matthew I have spoken to Adrian/RevK It's something they are looking at but not a 'simple' change - so not something happening 'immediately'. Currently they set 'Chargeable-User-Identity' which is OK - and I could use that. The Firebrick does not hold the username (as things stand) once the session is setup - BUT we don't have the chargeable ID until the auth start hits freeradius Which means it's not available at the time of the IP allocation The reason for not returning the Framed-IP they say is that the devices allow multiple IPs and the framed IP can be changed with a CoA request even - which can be nice - you can even have multiple routing tables - so you can have the sane IP in multiple IPs in different tables in a scenario like this (putting some users into walled gardens). Obviously in this scenario it won't change I totally agree it is unhelpful in this case and I am not defending them - Just some of their thinking when I asked them- I will continue to nudge this one! These are the big brother of the 2900's (the 6000s :) This is v3 here - though happy to use / test v4 if that works for this scenario Could you possibly point me at some documentation for either - Happy to read and test with these. I have https://networkradius.com/doc/3.0.8/raddb/mods-available/redis.html which I am working through and seems sensible - but any pointers welcomed I'll have a read of that and see how I get on - I may come back with more questions Thanks for the pointers so far Richard On Sunday 07/04/2019 at 8:07 pm, Matthew Newton wrote:
On Sun, 2019-04-07 at 14:47 -0400, Alan DeKok wrote:
On Apr 7, 2019, at 11:07 AM, Richard J Palmer <richard@merula.net> wrote:
The cause it seems is what the Interim updates send to Freeradius - the Router (a firebrick LNS server)
That's not only unusual, it's unfriendly. Most RADIUS clients send everything they know about the session in every accounting packet.
I can get round that in pre-acc by running:
It doesn't event send the User-Name? What a piece of garbage.
Richard, have you tried contacting RevK/Firebrick and asking if they can add that?
As Alan says, it's pretty unusual not to include those attributes (even though I'm not sure if any RFCs actually specify they _have_ to be included).
Firebricks are nice bits of kit (I've got a 2900), I'm guessing this is a case of "no need to do that if not explicitly stated in the RFCs".
is there a built in way to return the three columns from sql and then within FreeRadius and assign them into the items as need be.
You can grab the 3 parameters in one SQL query, and then separate them via a regex. But that's about it.
Can use a map{} in v4. Or (in v3) backend it with Redis, which will pull this stuff back before SQL has even parsed the query.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 7, 2019, at 3:24 PM, Richard J Palmer <richard@merula.net> wrote:
I have spoken to Adrian/RevK It's something they are looking at but not a 'simple' change - so not something happening 'immediately'.
If there's a User-Name, it should be sent in accounting packets. The same goes for Calling-Station-ID, which is usually the MAC address. Doing anything else is severely unfriendly to every other RADIUS system.
Currently they set 'Chargeable-User-Identity' which is OK - and I could use that. The Firebrick does not hold the username (as things stand) once the session is setup
- BUT we don't have the chargeable ID until the auth start hits freeradius Which means it's not available at the time of the IP allocation
I'm not sure I understand that. CUI is sent by the RADIUS server to the NAS. The NAS *never* creates a CUI and sends it to the server. See RFC 4372 for details.
The reason for not returning the Framed-IP they say is that the devices allow multiple IPs and the framed IP can be changed with a CoA request even - which can be nice - you can even have multiple routing tables - so you can have the sane IP in multiple IPs in different tables in a scenario like this (putting some users into walled gardens). Obviously in this scenario it won't change
That doesn't make sense. If the RADIUS server sends a Framed-IP-Address to the NAS, the NAS should echo it back in accounting packets. If the Framed-IP-Address is changed in a CoA request, then the NAS should echo the *new* Framed-IP-Address in subsequent accounting requests.
I totally agree it is unhelpful in this case and I am not defending them - Just some of their thinking when I asked them- I will continue to nudge this one!
They can ask RADIUS people for help. i.e. EVERYONE PLEASE ASK. It's better to fix things in the engineering stage. The alternative is to ship garbage, and then have the poor users wonder why the software isn't compatible with anything else. Alan DeKok.
participants (2)
-
Alan DeKok -
Richard J Palmer