rlm_python: no %RAD_REQUEST equivalent
Hello, I have a perl module that changes the username during the authorization phase (retrieve from a oracle database) by modifying the user-name attribute in the RAD_REQUEST dictionary. This update is global and can be used by the authentication phase (still handled by the perl script). I try to switch from perl to python as i'm more comfortable. Everything is ok except i don't know how to modify on the fly the user-name. in the 'authorize(p)' function, p is the read only tuple of the request. I cannot update the request here. The return of the function is (RLM_MODULE_something, tuple4reply, tuple4config). I still cannot change here. Moreover, if i change the tuple config in the authorize function , how i can retrieve it in the authentication function? Maybe i miss something as i'm a beginner on FR. Regards, Laurent
laurent.feron@free.fr wrote:
in the 'authorize(p)' function, p is the read only tuple of the request. I cannot update the request here.
Hmm... you should be able to update it. If you can't, the code should be changed.
Moreover, if i change the tuple config in the authorize function , how i can retrieve it in the authentication function?
You get passed the tuple again. It's just a list of attributes. Alan DeKok.
Hi, Thanks for your reply. The tuple is a read only object. So, i cannot modify the request attributes with rlm_python. Unfortunately, this module is more limited than the perl one. i have to continue with this one... Regards, Laurent ----- Mail original ----- De: "Alan DeKok" <aland@deployingradius.com> À: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Envoyé: Lundi 24 Septembre 2012 18:06:03 Objet: Re: rlm_python: no %RAD_REQUEST equivalent laurent.feron@free.fr wrote:
in the 'authorize(p)' function, p is the read only tuple of the request. I cannot update the request here.
Hmm... you should be able to update it. If you can't, the code should be changed.
Moreover, if i change the tuple config in the authorize function , how i can retrieve it in the authentication function?
You get passed the tuple again. It's just a list of attributes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes i confirm you cannot change the request's attributes with rlm_python. With rlm_perl you can (by using the environment variable RAD_REQUEST). I wanted to modify the username. So the only solution would be to modify and update the rlm_python code source. But it is too hard for me... regards, Laurent ----- Mail original ----- De: "Alan DeKok" <aland@deployingradius.com> À: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Envoyé: Mardi 25 Septembre 2012 15:25:53 Objet: Re: rlm_python: no %RAD_REQUEST equivalent laurent.feron@free.fr wrote:
The tuple is a read only object. So, i cannot modify the request attributes with rlm_python.
You already said that. I gave you a solution: fix the code. Alan Dekok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello, I saw in many messages that with the module sql it is possible to do authentication against sql table and also to have the NAS definition in another table. Is it possible to have only the configuration of NAS in a sql table? The authorization and authentication are done with other modules (perl scriptings). Regards, Laurent
laurent.feron@free.fr wrote:
Hello, I saw in many messages that with the module sql it is possible to do authentication against sql table
No, it's not possible to do that. SQL is a *database*. Databases store data. They don't do authentication. SQL is used to store "known good" passwords. See the documentation and the Wiki for examples of how to store these passwords in SQL.
and also to have the NAS definition in another table. Is it possible to have only the configuration of NAS in a sql table? The authorization and authentication are done with other modules (perl scriptings).
Yes. There is no requirement to do everything in SQL. Alan DeKok.
in the mysql database, i would like only the 'nas' table, and not other tables (radcheck, ...). Is it possible? Regards laurent ----- Mail original ----- De: "Alan DeKok" <aland@deployingradius.com> À: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Envoyé: Mardi 27 Novembre 2012 22:03:28 Objet: Re: nas config in sql table laurent.feron@free.fr wrote:
Hello, I saw in many messages that with the module sql it is possible to do authentication against sql table
No, it's not possible to do that. SQL is a *database*. Databases store data. They don't do authentication. SQL is used to store "known good" passwords. See the documentation and the Wiki for examples of how to store these passwords in SQL.
and also to have the NAS definition in another table. Is it possible to have only the configuration of NAS in a sql table? The authorization and authentication are done with other modules (perl scriptings).
Yes. There is no requirement to do everything in SQL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 29 Nov 2012, at 13:59, Alan DeKok <aland@DEPLOYINGRADIUS.COM> wrote:
laurent.feron@free.fr wrote:
in the mysql database, i would like only the 'nas' table, and not other tables (radcheck, ...). Is it possible?
I said "yes". What other answer are you looking for?
You can drop the other tables, just put sql in radiusd.conf instantiate and comment out the references everywhere else. -Arran
I removed 'sql' from authorize to instantiate and i confirm every thing is ok, i dropped the other tables, cleaned sql.conf & dialup.conf and keep only the needed info for the nas table. Many thanks !! Laurent ----- Mail original ----- De: "Arran Cudbard-Bell" <a.cudbardb@freeradius.org> À: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Envoyé: Jeudi 29 Novembre 2012 16:17:36 Objet: Re: nas config in sql table On 29 Nov 2012, at 13:59, Alan DeKok <aland@DEPLOYINGRADIUS.COM> wrote:
laurent.feron@free.fr wrote:
in the mysql database, i would like only the 'nas' table, and not other tables (radcheck, ...). Is it possible?
I said "yes". What other answer are you looking for?
You can drop the other tables, just put sql in radiusd.conf instantiate and comment out the references everywhere else. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello, In a perl script (where authorize() and authenticate() are defined), i was able to set a global variable. when a radius request comes, the script may modify the variable, and the next request has the new value. I test with radiusd -X, and everything is fine. when radiusd is started as a daemon, 5 threads (default value) are started. And now, i understood i have 5 different perl "environments". Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread). I hope my explanation is clear. I would like to know if it possible to have a unique sharing enviroment (the basic solution is maybe to have only one thread, but it should be good for performance) Just for your information, i would like to "cache" some information... the script has to find which OTP server the user is defined on. The second time the search is not necessary... i use Tie::Hash::Expire module for caching information. Regards, Laurent
On 29 Nov 2012, at 22:14, laurent.feron@free.fr wrote:
Hello,
In a perl script (where authorize() and authenticate() are defined), i was able to set a global variable. when a radius request comes, the script may modify the variable, and the next request has the new value. I test with radiusd -X, and everything is fine.
when radiusd is started as a daemon, 5 threads (default value) are started. And now, i understood i have 5 different perl "environments". Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread).
I hope my explanation is clear. I would like to know if it possible to have a unique sharing enviroment (the basic solution is maybe to have only one thread, but it should be good for performance)
No, submit patches if you want this functionality. -Arran
Arran Cudbard-Bell wrote:
On 29 Nov 2012, at 22:14, laurent.feron@free.fr wrote:
Hello,
In a perl script (where authorize() and authenticate() are defined), i was able to set a global variable. when a radius request comes, the script may modify the variable, and the next request has the new value. I test with radiusd -X, and everything is fine.
when radiusd is started as a daemon, 5 threads (default value) are started. And now, i understood i have 5 different perl "environments". Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread).
I hope my explanation is clear. I would like to know if it possible to have a unique sharing enviroment (the basic solution is maybe to have only one thread, but it should be good for performance)
No, submit patches if you want this functionality.
You can explicitly share data between perl interpreters. However you'll need to explicitly lock shared data. See perldoc threads::shared for details. use threads; # this module contains share() and lock() use threads::shared; # hashes get empty on share my %sharedhash; share(%sharedhash); sub put($$) { my ($key, $value) = @_ lock(%sharedhash); $sharedhash{$key} = share($value); return; } sub get($) { my ($key) = @_; lock(%sharedhash); my $value = $sharedhash{$key}; return $value; } But I think it's better to store shared data in some sort of storage, for example redis or sql database.
Hello, thanks for your respond. I tried memcached as suggested by John Denins. Seems working very well. i thought of Redis, if memcached does not satisfied me (i don't see), Redis could be an option. In term of security, i have to be sure that information in memcached can be secured, and not public. Regards, Laurent ----- Mail original ----- De: "Iliya Peregoudov" <iperegudov@cboss.ru> À: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Envoyé: Mardi 4 Décembre 2012 08:14:13 Objet: Re: share variables in perl script (rlm_perl) Arran Cudbard-Bell wrote:
On 29 Nov 2012, at 22:14, laurent.feron@free.fr wrote:
Hello,
In a perl script (where authorize() and authenticate() are defined), i was able to set a global variable. when a radius request comes, the script may modify the variable, and the next request has the new value. I test with radiusd -X, and everything is fine.
when radiusd is started as a daemon, 5 threads (default value) are started. And now, i understood i have 5 different perl "environments". Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread).
I hope my explanation is clear. I would like to know if it possible to have a unique sharing enviroment (the basic solution is maybe to have only one thread, but it should be good for performance)
No, submit patches if you want this functionality.
You can explicitly share data between perl interpreters. However you'll need to explicitly lock shared data. See perldoc threads::shared for details. use threads; # this module contains share() and lock() use threads::shared; # hashes get empty on share my %sharedhash; share(%sharedhash); sub put($$) { my ($key, $value) = @_ lock(%sharedhash); $sharedhash{$key} = share($value); return; } sub get($) { my ($key) = @_; lock(%sharedhash); my $value = $sharedhash{$key}; return $value; } But I think it's better to store shared data in some sort of storage, for example redis or sql database. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 12/04/2012 09:30 AM, laurent.feron@free.fr wrote:
Hello, thanks for your respond. I tried memcached as suggested by John Denins. Seems working very well. i thought of Redis, if memcached does not satisfied me (i don't see), Redis could be an option. In term of security, i have to be sure that information in memcached can be secured, and not public.
The simplest and most secure way to secure memcached is by using unix sockets if your memcached instance is running on the same machine as your memcache clients (e.g. radiusd). The memcache data won't be accessible remotely because memcached is not listening on an inet socket. Use appropriate ownership and permissions on the socket file. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On 11/29/2012 05:14 PM, laurent.feron@free.fr wrote:
Hello,
In a perl script (where authorize() and authenticate() are defined), i was able to set a global variable. when a radius request comes, the script may modify the variable, and the next request has the new value. I test with radiusd -X, and everything is fine.
when radiusd is started as a daemon, 5 threads (default value) are started. And now, i understood i have 5 different perl "environments". Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread).
I hope my explanation is clear. I would like to know if it possible to have a unique sharing enviroment (the basic solution is maybe to have only one thread, but it should be good for performance)
Just for your information, i would like to "cache" some information... the script has to find which OTP server the user is defined on. The second time the search is not necessary... i use Tie::Hash::Expire module for caching information.
Is there a problem with having each thread perform it's own caching? It will take slightly longer to populate the cache than if it was shared but is that an issue in practice? You could borrow a technique from web servers where requests are typically processed in independent processes but shared caching between the processes is desired by utilizing memcache. memcached is a stand alone process (daemon) that holds a hash table in memory and processes connect to it via sockets (either inet or unix). There are several memcache client language bindings, pretty sure there is one for Perl. Google memcache, you'll find a ton of information about it. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Hello Laurent,
Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread).
I had the very same problem when I was implementing the smsotp perl module. I only noticed when the system was already in production. As a quick work around I limited the radius threads to '1'. And than I used berkeley db to save the state. Have a look at the smsotp code, it only took 30 minutes to implement. It is very straight forward. You can use also a database like postgresql to obtain the same. http://thomas.glanzmann.de/smsotpd.2012-10-05.tar.bz2 Cheers, Thomas
only 1 thread ? what 's about performance? yes, many thanks, i will look at your code Regards, Laurent ----- Mail original ----- De: "Thomas Glanzmann" <thomas@glanzmann.de> À: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Envoyé: Samedi 1 Décembre 2012 16:11:35 Objet: Re: share variables in perl script (rlm_perl) Hello Laurent,
Meaning, when i start the first radtest that modifies the global variable, only the sixth request can view the global variable modified by the first request( i guess the sixth one turns into the first thread).
I had the very same problem when I was implementing the smsotp perl module. I only noticed when the system was already in production. As a quick work around I limited the radius threads to '1'. And than I used berkeley db to save the state. Have a look at the smsotp code, it only took 30 minutes to implement. It is very straight forward. You can use also a database like postgresql to obtain the same. http://thomas.glanzmann.de/smsotpd.2012-10-05.tar.bz2 Cheers, Thomas - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (6)
-
Alan DeKok -
Arran Cudbard-Bell -
Iliya Peregoudov -
John Dennis -
laurent.feron＠free.fr -
Thomas Glanzmann