Juniper-Local-User-Name reply attribute
Hi List, I have the following unlang, which works: if (&myAttribute == "srx") { update reply { Cisco-AVPair := "limited" Service-Type := Login-User } } The reply attributes are sent in the Access-Accept as expected: (234) Thu Oct 27 14:56:56 2016: Debug: Sent Access-Accept Id 241 from IP1 to IP2 length 0 (234) Thu Oct 27 14:56:56 2016: Debug: Cisco-AVPair = "limited" (234) Thu Oct 27 14:56:56 2016: Debug: Service-Type = Login-User If I change the unlang to the following, the Juniper-Local-User-Name does not appear in the Access-Accept. The rest of the debug output for entering the if statement looks identical. if (&myAttribute == "srx") { update reply { Juniper-Local-User-Name := "limited" Service-Type := Login-User } } I have confirmed that the proper dictionary exists on the server: # grep Juniper-Local-User-Name /usr/share/freeradius/dictionary.juniper ATTRIBUTE Juniper-Local-User-Name 1 string # radiusd -v radiusd: FreeRADIUS Version 3.0.10, for host x86_64-redhat-linux-gnu, built on Oct 5 2015 at 16:30:01 Any ideas? Unfortunately, I can't trick my Juniper SRX device into accepting Cisco-AVPair attributes. Thanks, Dave
On Oct 27, 2016, at 3:13 PM, Dave Aldwinckle <daldwinc@uwaterloo.ca> wrote:
If I change the unlang to the following, the Juniper-Local-User-Name does not appear in the Access-Accept. The rest of the debug output for entering the if statement looks identical.
if (&myAttribute == "srx") { update reply { Juniper-Local-User-Name := "limited" Service-Type := Login-User } }
I have confirmed that the proper dictionary exists on the server:
Ok...
Any ideas?
What does the full debug output say? We can make guesses from zero information. Which is why we always ask for the debug output.
Unfortunately, I can't trick my Juniper SRX device into accepting Cisco-AVPair attributes.
That's by design. Vendor-specific attributes are specific to each vendor. Alan DeKok.
Hi Alan,
Unfortunately, I can't trick my Juniper SRX device into accepting Cisco-AVPair attributes.
That's by design. Vendor-specific attributes are specific to each vendor.
Heh. That was a joke. Not funny I guess.
What does the full debug output say? We can make guesses from zero information. Which is why we always ask for the debug output.
The full debug contains a lot of sensitive info, which is why I only send it as a last resort, and after heavy sanitization. I understand that this can be frustrating for you and others who help out on the list. My apologies. I fixed my problem by modifying the file mods-config/attr_filter/post-proxy and adding the line: Juniper-Local-User-Name =* ANY Regards, Dave
On Oct 27, 2016, at 3:21 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Oct 27, 2016, at 3:13 PM, Dave Aldwinckle <daldwinc@uwaterloo.ca> wrote:
If I change the unlang to the following, the Juniper-Local-User-Name does not appear in the Access-Accept. The rest of the debug output for entering the if statement looks identical.
if (&myAttribute == "srx") { update reply { Juniper-Local-User-Name := "limited" Service-Type := Login-User } }
I have confirmed that the proper dictionary exists on the server:
Ok...
Any ideas?
What does the full debug output say? We can make guesses from zero information. Which is why we always ask for the debug output.
Unfortunately, I can't trick my Juniper SRX device into accepting Cisco-AVPair attributes.
That's by design. Vendor-specific attributes are specific to each vendor.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The full debug contains a lot of sensitive info, which is why I only send it as a last resort, and after heavy sanitization. I understand that this can be frustrating for you and others who help out on the list. My apologies.
Sometimes if that's what it takes, provided it doesn't substantially change things, it's necessary...
I fixed my problem by modifying the file mods-config/attr_filter/post-proxy and adding the line:
Juniper-Local-User-Name =* ANY
Yeah, if you're running attribute filters, this would be needed, yes. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
participants (4)
-
Alan DeKok -
Dave Aldwinckle -
David Aldwinckle -
Stefan Paetow