Proxy based on Multiple Realms
What I want to do is proxy requests based on being in multiple realms. For example: Realm1/username.Realm2 Where is Realm1 is "host" AND Realm2 is "some.fqdn" then proxy to xxx.xxx.xxx.xxx Specifically what I am doing is trying to use FreeRadius to proxy for AD Domains. I want to enable host based authentication (i.e. host/ workstation.domain.name ) but for multiple domains. I believe proxying is the only why to accomplish this. All I can find are references/warnings to making sure that I DON'T do this by mistake. Problem is I believe this is what I must do. Is this even possible with FreeRadius? Thanks Bob
Hi,
What I want to do is proxy requests based on being in multiple realms. For example: Realm1/username.Realm2
so long as the second part with always be username.realm2 (and you dont get into user.name.realm2 then you can use 2.1.x with unlang to configure what you need. you need to use a decent regex parttern to match $1/[string].$2 (in fact, you can simply ignore $1 as it will always be host/ if dealing with type of traffic i expect)...and then you can simply set the proxy-to-realm to be equal to the $2 value. however, this is not a trivial 'it'll just work' and the realm details might not be the sites real NAI realm (as it might be an internal AD realm that has no basis on real world name, for example). PS in eduroam we only allow the authentication of users via RFC NAI values - this stops this nasty machine authentication mess (which most RADIUS servers will not be able to handle) - i guess this is a demonstration of FR power/flexibility rather than common use :-) alan
Perfect, I think that is exactly what I want, but I'm hoping you might be able to help me with the syntax. I am trying this, but is doesn't seem to work: # - From the proxy.conf file: realm host { if ( Stripped-User-Name =~ ".*\.domain\.name" ) { pool = adradius nostrip } } Thanks Bob On Thu, Oct 15, 2009 at 3:38 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
What I want to do is proxy requests based on being in multiple realms. For example: Realm1/username.Realm2
so long as the second part with always be username.realm2 (and you dont get into user.name.realm2 then you can use 2.1.x with unlang to configure what you need. you need to use a decent regex parttern to match
$1/[string].$2 (in fact, you can simply ignore $1 as it will always be host/ if dealing with type of traffic i expect)...and then you can simply set the proxy-to-realm to be equal to the $2 value.
however, this is not a trivial 'it'll just work' and the realm details might not be the sites real NAI realm (as it might be an internal AD realm that has no basis on real world name, for example).
PS in eduroam we only allow the authentication of users via RFC NAI values - this stops this nasty machine authentication mess (which most RADIUS servers will not be able to handle) - i guess this is a demonstration of FR power/flexibility rather than common use :-)
alan
Perfect, I think that is exactly what I want, but I'm hoping you might be able to help me with the syntax. I am trying this, but is doesn't seem to work:
# - From the proxy.conf file: realm host { if ( Stripped-User-Name =~ ".*\.domain\.name" ) { pool = adradius nostrip } }
You can't use unlang in proxy.conf file. Use it in virtual server configuration (authorize section). Ivan Kalik Kalik Informatika ISP
Okay, perfect that was part of the answer I needed, Thanks! I guess I now have two more questions: 1. Is there a way to "manually" specify a proxy or Realm in the authorize section? 2. Is there a way to modify the Realms file to find a realm find the realm domain.name in from within user.domain.name. Whenever I try I only get the Realm name not domain.name. (i.e. I want it to pick up from the first . character not the last ) Thanks Bob
Hi,
Okay, perfect that was part of the answer I needed, Thanks!
I guess I now have two more questions:
1. Is there a way to "manually" specify a proxy or Realm in the authorize section?
2. Is there a way to modify the Realms file to find a realm find the realm domain.name in from within user.domain.name. Whenever I try I only get the Realm name not domain.name. (i.e. I want it to pick up from the first . character not the last )
add a small bit of unlang to the default site... eg (and this is conceptual, not real code!) if User-Name contains/ends in .domain.name then update the realm identifier to be domain.name in reality this would be *something* (ie no guarantees, check debug etc to work out why it doesnt work etc) like if("%{User-Name}" =~ /\.domain\.name$/) { update request { Realm := 'domain.name' } update control { Proxy-To-Realm := 'domain.name' } } alan
1. Is there a way to "manually" specify a proxy or Realm in the authorize section?
Yes. update control { Proxy-To-Realm := "some_realm" }
2. Is there a way to modify the Realms file to find a realm find the realm domain.name in from within user.domain.name. Whenever I try I only get the Realm name not domain.name. (i.e. I want it to pick up from the first . character not the last )
So put prefix not suffix as format. But that will break down if you allow dots in usernames, like: Sam.Body.domain.name Ivan Kalik Kalik Informatika ISP
Great I'll try the update control.. As for Realms file, I did try using prefix instead of suffix, but in the case of username.domain.name, it says that the Realm is username and the Stripped User name is domain.name Thanks Bob On Tue, Oct 20, 2009 at 10:21 AM, Ivan Kalik <tnt@kalik.net> wrote:
1. Is there a way to "manually" specify a proxy or Realm in the authorize section?
Yes.
update control { Proxy-To-Realm := "some_realm" }
2. Is there a way to modify the Realms file to find a realm find the realm domain.name in from within user.domain.name. Whenever I try I only get the Realm name not domain.name. (i.e. I want it to pick up from the first . character not the last )
So put prefix not suffix as format. But that will break down if you allow dots in usernames, like:
Sam.Body.domain.name
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- The problem with socialism is that you eventually run out of other people's money. - Margaret Thatcher
Okay, just to update everyone and for others that might search this mail-listing: I have finally gotten it, using the code below in the authorize section I can send host authentication to multiple proxies based on domain name if ( User-Name =~ /^host\//i ) { if ( User-Name =~ /\\.first\\.domain$/i ) { update control { Proxy-To-Realm := "first.domain" } } if ( User-Name =~ /\\.second\\.domain$/i ) { update control { Proxy-To-Realm := "second.domain" } } if ( User-Name =~ /\\.first\\.domain$/i ) { update control { Proxy-To-Realm := "third.domain" } } } For whatever reason I had to use 2 backslashes in front of the period in the domain names?? But anyway, this part of the project is working. Thanks for all the help! Bob
Hi,
if ( User-Name =~ /^host\//i ) { if ( User-Name =~ /\\.first\\.domain$/i ) { update control { Proxy-To-Realm := "first.domain" } } if ( User-Name =~ /\\.second\\.domain$/i ) { update control { Proxy-To-Realm := "second.domain" } } if ( User-Name =~ /\\.first\\.domain$/i ) { update control { Proxy-To-Realm := "third.domain" } } }
will that 4th if ever work (first.domain being sent to third.domain) as the match would have already happened on the 2nd if...... alan
Oops, just a typo.... :) Anyway I have tested it with one domains, (I will have more in the future) but in theory it should work and my testing using RADNTPING and RADIUS -X shows that it should. Thanks Bob On Tue, Oct 20, 2009 at 12:36 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk>wrote:
Hi,
if ( User-Name =~ /^host\//i ) { if ( User-Name =~ /\\.first\\.domain$/i ) { update control { Proxy-To-Realm := "first.domain" } } if ( User-Name =~ /\\.second\\.domain$/i ) { update control { Proxy-To-Realm := "second.domain" } } if ( User-Name =~ /\\*.third*\\.domain$/i ) { update control { Proxy-To-Realm := "third.domain" } } }
will that 4th if ever work (first.domain being sent to third.domain) as the match would have already happened on the 2nd if......
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- The problem with socialism is that you eventually run out of other people's money. - Margaret Thatcher
participants (3)
-
Alan Buxey -
Bob Brandt -
Ivan Kalik