Value-pairs from exec script
I have an exec script that returns a User-Name. FreeRADIUS passes the User-Name to my script (ie MyOldUsername) and my script changes it (ie MyNewUsername). In my logs I see Exec-Program-Wait: value-pairs: User-Name = MyNewUsername so I know my script is working and returning correctly. My problem is that FreeRADIUS doesn't take MyNewUsername from the script and MyOldUsername gets inserted into the radacct table. Below is my exec config. My script is a PHP script on a web server that gets called via wget. One thing that I'm not sure of is what input_pairs and output_pairs should be set to. I see that "config" and "reply" are valid options, but what is the difference between them? What other information is needed in order to troubleshoot this problem? exec { wait = yes program = `/usr/bin/wget -q -O - 127.0.0.1/%{Calling-Station-Id}` shell_escape = yes input_pairs = config output_pairs = config }
Brian Wallen wrote:
I have an exec script that returns a User-Name. FreeRADIUS passes the User-Name to my script (ie MyOldUsername) and my script changes it (ie MyNewUsername). In my logs I see
Exec-Program-Wait: value-pairs: User-Name = MyNewUsername
The attributes from exec-program-wait are added to the end of the existing attribute list. They're not replacing existing ones. I suggest using Perl. Alan DeKok.
Thanks for the suggestion, Alan. I've rewritten my script in Perl but I'm still having the same issue. In my log I see two pairs for User-Name: rlm_perl: Added pair User-Name = MyOldUsername rlm_perl: Added pair User-Name = MyNewUsername So how to I make rlm_perl change/overwrite the value of User-Name rather than add a second User-Name pair? I tried returning updated rather than ok, but that didn't seem to make any difference. In my script I have $RAD_REPLY{'User-Name'} = 'MyNewUsername'; Is there maybe an operator besides = that I should use? On Wed, Mar 6, 2013 at 10:27 AM, Alan DeKok <aland@deployingradius.com>wrote:
Brian Wallen wrote:
I have an exec script that returns a User-Name. FreeRADIUS passes the User-Name to my script (ie MyOldUsername) and my script changes it (ie MyNewUsername). In my logs I see
Exec-Program-Wait: value-pairs: User-Name = MyNewUsername
The attributes from exec-program-wait are added to the end of the existing attribute list. They're not replacing existing ones.
I suggest using Perl.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Brian Wallen wrote:
Thanks for the suggestion, Alan. I've rewritten my script in Perl but I'm still having the same issue. In my log I see two pairs for User-Name:
Because that's probably what you told it to do.
rlm_perl: Added pair User-Name = MyOldUsername rlm_perl: Added pair User-Name = MyNewUsername
So how to I make rlm_perl change/overwrite the value of User-Name rather than add a second User-Name pair? I tried returning updated rather than ok, but that didn't seem to make any difference. In my script I have
$RAD_REPLY{'User-Name'} = 'MyNewUsername';
Is there maybe an operator besides = that I should use?
No. Normal Perl should work. So... what does your script do? Can you pare it down to an example you can post here? Otherwise, you message is little more than "it doesn't work". Alan DeKok.
Here's a paste of it (https://gist.github.com/anonymous/5102003). I took the example.pl script and modified the authorize section. I'm trying to allow users to walk/roam between access points without having to re-authenticate when they get handed off to the new access point. I set the APs to try mac authentication first, then my script runs and checks if they were previously authenticated at another AP. If so, it disconnects them from the old AP and reconnects them to the new AP and the user doesn't have to log in again. That all works. The only thing is that when a user moves from one AP to another and gets authenticated via their mac address, the username in the radacct SQL table is set to the mac address. I'm trying to change User-Name to the actual username. I'm just getting a second User-Name pair instead of replacing the existing one. On Wed, Mar 6, 2013 at 2:56 PM, Alan DeKok <aland@deployingradius.com>wrote:
Brian Wallen wrote:
Thanks for the suggestion, Alan. I've rewritten my script in Perl but I'm still having the same issue. In my log I see two pairs for User-Name:
Because that's probably what you told it to do.
rlm_perl: Added pair User-Name = MyOldUsername rlm_perl: Added pair User-Name = MyNewUsername
So how to I make rlm_perl change/overwrite the value of User-Name rather than add a second User-Name pair? I tried returning updated rather than ok, but that didn't seem to make any difference. In my script I have
$RAD_REPLY{'User-Name'} = 'MyNewUsername';
Is there maybe an operator besides = that I should use?
No. Normal Perl should work.
So... what does your script do? Can you pare it down to an example you can post here? Otherwise, you message is little more than "it doesn't work".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Brian Wallen wrote:
Here's a paste of it (https://gist.github.com/anonymous/5102003).
Updating the User-Name entry should result in it being replaced, not added to. I suspect you're misreading the debug output. And there's no need to run radclient to disconnect a user. See raddb/sites-available/originate-coa. The server core can do this. Alan DeKok.
Thanks for the originate-coa tip, I didn't know about that. I don't think I'm misreading the debug output. When I go into the MySQL DB, I see a mac address as a username. Do I need to add something like update control { User-Name := ??? } to my config? On Wed, Mar 6, 2013 at 3:18 PM, Alan DeKok <aland@deployingradius.com>wrote:
Brian Wallen wrote:
Here's a paste of it (https://gist.github.com/anonymous/5102003).
Updating the User-Name entry should result in it being replaced, not added to. I suspect you're misreading the debug output.
And there's no need to run radclient to disconnect a user. See raddb/sites-available/originate-coa. The server core can do this.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Brian Wallen wrote:
Thanks for the originate-coa tip, I didn't know about that.
I don't think I'm misreading the debug output.
Well, you're not posting it here. Perl is pretty simple. $RAD_REPLY{'User-Name'} = "foo" does what you expect. It *sets* the User-Name to that value. It doesn't *add* a new User-Name.
When I go into the MySQL DB, I see a mac address as a username. Do I need to add something like
update control { User-Name := ??? }
to my config?
I have no idea. Fix one problem at a time. Don't go trying random solutions until you've (a) understood, and (b) fixed the original problem. Alan DeKok.
Hi,
Here's a paste of it (https://gist.github.com/anonymous/5102003). I took the example.pl script and modified the authorize section. I'm trying to allow users to walk/roam between access points without having to re-authenticate when they get handed off to the new access point. I set the APs to try mac authentication first, then my script runs and checks if they were previously authenticated at another AP. If so, it disconnects them from the old AP and reconnects them to the new AP and the user doesn't have to log in again. That all works. The only thing is that when a user moves from one AP to another and gets authenticated via their mac address, the username in the radacct SQL table is set to the mac address. I'm trying to change User-Name to the actual username. I'm just getting a second User-Name pair instead of replacing the existing one.
I assume that you cant use any of the 802.11 inter-AP roaming protocols that would allow native roaming without the re-auth at all? or that you have APs that dont have a central controller that can do roaming/mobility? why play with User-Name - you could use another local temporary attribute for the test/update that you are doing alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Brian Wallen