Hello, I’m using a Freeradius 4.0.x release with the rlm_rest module to store the accounting datas inside a key/value database. Storing accounting items works well, and also authorization, but I’m not able to perform authentication using the stored datas (as for MySQL). If anyone have an idea ? rlm_rest/accounting section accounting { uri = "${..connect_uri}/v2/keys/%{Framed-IP-Address}" method = 'put' body = 'post' data = "value=\"Cleartext-Password\": \"%{Framed-IP-Address}\",\"Calling-Station-Id\": \"%{Calling-Station-ID}\",\"3GPP-Location-Info\": \"%{3GPP-User-Location-Info}\",\"3GPP-SGSN-Address\": \"%{3GPP-SGSN-Address}\",\"3GPP-RAT-Type\": \"%{3GPP-RAT-Type}\"" } CLI command is : echo "Calling-Station-Id=237100000002,Framed-IP-Address=201.16.124.239,Service-Type=2,Framed-Protocol=ppp,Acct-Status-Type=Start,3GPP-SGSN-Address=70.70.70.70,3GPP-Location-Info=0x5c2730783030315c27,NAS-IP-Address=10.171.23.53,NAS-Port=1,3GPP-Rat-Type=0x01" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1813 acct testing123 Sent Accounting-Request Id 49 from 0.0.0.0:47843 to 10.104.145.4:1813 length 108 Calling-Station-Id = "237100000002" Framed-IP-Address = 201.16.124.239 Service-Type = Framed-User Framed-Protocol = PPP Acct-Status-Type = Start 3GPP-SGSN-Address = 70.70.70.70 3GPP-Location-Info = 0x5c2730783030315c27 NAS-IP-Address = 10.171.23.53 NAS-Port = 1 3GPP-RAT-Type = UTRAN Received Accounting-Response Id 49 from 10.104.145.4:1813 to 0.0.0.0:47843 via lo length 20 And the datas are correctly stored. Raddebug seems fine for accounting : Network received packet size 108 Ready to process requests Resetting worker cleanup timer to +30s (0) running request (0) Received Accounting-Request ID 49 (0) Calling-Station-Id = "237100000002" (0) Framed-IP-Address = 201.16.124.239 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Acct-Status-Type = Start (0) 3GPP-SGSN-Address = 70.70.70.70 (0) 3GPP-Location-Info = 0x5c2730783030315c27 (0) NAS-IP-Address = 10.171.23.53 (0) NAS-Port = 1 (0) 3GPP-RAT-Type = UTRAN (0) Running 'recv Accounting-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) recv Accounting-Request { (0) acct_unique { (0) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (0) EXPAND %{string:Class} (0) --> (0) ... (0) } (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> 6f0ca34d8adc2578048d2d1f4bb0f025 (0) &Acct-Unique-Session-Id := 6f0ca34d8adc2578048d2d1f4bb0f025 (0) } # update request (noop) (0) } # else (noop) (0) } # acct_unique (noop) (0) check_accounting_attributes { (0) if (Acct-Status-Type == Start) { (0) if ((!NAS-IP-Address) || (!Service-Type) || (!Framed-Protocol) || (!Framed-IP-Address) || (!3GPP-SGSN-Address) || (!3GPP-RAT-Type) || (!Calling-Station-Id)) { (0) ... (0) } (0) else { (0) ok (ok) (0) } # else (ok) (0) } # if (Acct-Status-Type == Start) (ok) (0) } # check_accounting_attributes (ok) (0) } # recv Accounting-Request (ok) (0) Running 'send Accounting-Response' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) send Accounting-Response { (0) detail - EXPAND /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (0) detail - --> /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - EXPAND %t (0) detail - --> Tue Nov 7 10:23:22 2017 (0) detail (ok) (0) unix (noop) (0) rest - Reserved connection (4) (0) rest - Expanding URI components (0) rest - EXPAND http://10.104.145.4:2379 (0) rest - --> http://10.104.145.4:2379 (0) rest - EXPAND /v2/keys/%{Framed-IP-Address} (0) rest - --> /v2/keys/201.16.124.239 (0) rest - Sending HTTP PUT to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (0) rest - EXPAND value="Cleartext-Password": "%{Framed-IP-Address}","Calling-Station-Id": "%{Calling-Station-ID}","3GPP-Location-Info": "%{3GPP-Location-Info}","3GPP-SGSN-Address": "%{3GPP-SGSN-Address}","3GPP-RAT-Type": "%{3GPP-RAT-Type}" (0) rest - --> value="Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - Content-Length will be 186 bytes (0) rest (yield) Waking up in 2.9 seconds. (0) Processing response header (0) Status : 200 (OK) (0) Type : json (application/json) (0) running request (0) rest - &REST-HTTP-Status-Code := 200 (0) rest - Parsing attribute "action" (0) rest - EXPAND set (0) rest - --> set (0) rest - &action := "set" (0) rest - Parsing attribute "node" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200088 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200088 (0) rest - Parsing attribute "prevNode" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200087 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200087 (0) rest - Released connection (4) (0) rest - Closing expired connection (3): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (2): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (1): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (0): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest (updated) (0) if (noop) { (0) ... (0) } (0) attr_filter.accounting_response - EXPAND %{User-Name} (0) attr_filter.accounting_response - --> (0) attr_filter.accounting_response - Matched entry DEFAULT at line 12 (0) attr_filter.accounting_response (updated) (0) } # send Accounting-Response (updated) (0) Sent Accounting-Response Id 49 from 10.104.145.4:1813 to 10.104.145.4:47843 via lo length 0 (0) done request (0) finished request. Ready to process requests Ready to process requests Ready to process requests For authorize and authenticate sections, I'm trying a GET using the URI on the User-name authorize { uri = "${..connect_uri}/v2/keys/%{User-Name}" method = 'get' body = ''' data = """ # tls = ${..tls} } (action, node, key and value words are declared in dictionary). echo "User-Name=201.16.124.239,NAS-Port=1812,Service-Type=8,NAS-Ip-Address=70.70.70.70,NAS-Identifier=1,Chap-Password=201.16.124.239,Chap-Challenge=1,Cleartext-Password=201.16.124.239" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1812 auth testing123 Sent Access-Request Id 128 from 0.0.0.0:50628 to 10.104.145.4:1812 length 79 User-Name = "201.16.124.239" NAS-Port = 1812 Service-Type = Authenticate-Only NAS-IP-Address = 70.70.70.70 NAS-Identifier = "1" CHAP-Password = 0x49c87256c50220fee804602c892c713d48 CHAP-Challenge = 0x31 Cleartext-Password = "201.16.124.239" Cleartext-Password = "201.16.124.239" Received Access-Reject Id 128 from 10.104.145.4:1812 to 0.0.0.0:50628 via lo length 20 (0) -: Expected Access-Accept got Access-Reject: Invalid character '' in attribute name I don’t see why the &value attribute isn’t parsed after Expanded : with raddebug : (1) running request (1) Received Access-Request ID 128 (1) User-Name = "201.16.124.239" (1) NAS-Port = 1812 (1) Service-Type = Authenticate-Only (1) NAS-IP-Address = 70.70.70.70 (1) NAS-Identifier = "1" (1) CHAP-Password = 0x49c87256c50220fee804602c892c713d48 (1) CHAP-Challenge = 0x31 (1) Running 'recv Access-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) recv Access-Request { (1) filter_user_password { (1) if (&User-Password) { (1) ... (1) } (1) } # filter_user_password (...) (1) rest - Closing connection (4): Hit idle_timeout, was idle for 1259 seconds (1) rest - You probably need to lower "min" (1) rest - 0 of 0 connections in use. You may need to increase "spare" (1) rest - Opening additional connection (5), 1 of 10 pending slots used (1) rest - Reserved connection (5) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (5) (1) rest - Need 4 more connections to reach min connections (5) (1) rest - Opening additional connection (6), 1 of 9 pending slots used (1) rest - Closing expired connection (5): Needs reconnecting (1) rest - You probably need to lower "min" (1) rest (updated) (1) check_authenticate_attributes { (1) if (!User-Password) { (1) update request { (1) &User-Password = &User-Name -> "201.16.124.239" (1) } # update request (noop) (1) update control { (1) &control:Auth-Type = rest (1) } # update control (noop) (1) } # if (!User-Password) (noop) (1) if ((!User-Name) || (!NAS-IP-Address) || (!Service-Type) || (!NAS-Identifier)) { (1) ... (1) } (1) else { (1) ok (ok) (1) } # else (ok) (1) } # check_authenticate_attributes (ok) (1) } # recv Access-Request (updated) (1) Running 'authenticate rest' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) authenticate rest { (1) rest - Reserved connection (6) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (6) (1) rest (updated) (1) } # authenticate rest (updated) (1) Failed to authenticate the user (1) Login incorrect: [201.16.124.239] (from client freeradius-cb-02 port 1812) (1) Running 'send Access-Reject' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) send Access-Reject { (1) attr_filter.access_reject - EXPAND %{User-Name} (1) attr_filter.access_reject - --> 201.16.124.239 (1) attr_filter.access_reject - Matched entry DEFAULT at line 11 (1) attr_filter.access_reject (updated) (1) } # send Access-Reject (updated) (1) Sent Access-Reject Id 128 from 10.104.145.4:1812 to 10.104.145.4:50628 via lo length 0 (1) done request (1) finished request. Ready to process requests Waking up in 29.9 seconds. Where is my error ? Best regards, Philippe _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.
On Nov 7, 2017, at 7:29 AM, philippe2.legoff@orange.com wrote:
I’m using a Freeradius 4.0.x release
There is no 4.0 release. The code in the v4.0.x branch changes on a daily basis. There's no guarantee that the configuration will stay the same for the final release. So... why 4.0? Why not use a 3.0 release? Alan DeKok.
interesting to play in 4.x - i would first look at this 'Invalid character '' in attribute name' . - how did you add those 4 values to the dictionary? alan On 7 November 2017 at 13:26, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 7, 2017, at 7:29 AM, philippe2.legoff@orange.com wrote:
I’m using a Freeradius 4.0.x release
There is no 4.0 release.
The code in the v4.0.x branch changes on a daily basis. There's no guarantee that the configuration will stay the same for the final release.
So... why 4.0? Why not use a 3.0 release?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 7, 2017, at 12:29 PM, philippe2.legoff@orange.com wrote:
Hello,
I’m using a Freeradius 4.0.x release with the rlm_rest module to store the accounting datas inside a key/value database. Storing accounting items works well, and also authorization, but I’m not able to perform authentication using the stored datas (as for MySQL).
You've not stated what type of authentication you're trying to perform? HTTP Basic-Auth, PAP, CHAP what? -Arran
participants (4)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
philippe2.legoff＠orange.com