Different realms for different databases
Hey, To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows: authenticate { ... Autz-Type SQL_EXAMPLE2 { sql_example2 } ... } Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section. What would be the way to configure accounting for the different realms in their correct databases? FreeRADIUS 1.1.7 and MySQL 5. Regards, Liran.
We are setting up freeradius 2.1.3. We have set read_groups = no in the sql.conf file Then no matter what we have fall-through attribute set to in radreply table in sql in nver even queries the group reply table. I have found references to this problem before but with no fix. All the docs and config files say this is how it is to work but it doesn't Is this feature broken at the moment or am i doing something wrong? Mark
We have set read_groups = no in the sql.conf file
Then no matter what we have fall-through attribute set to in radreply table in sql in nver even queries the group reply table.
It works for me. Post the debug for the same user with read_groups set to yes and set to no. Ivan Kalik Kalik Informatika ISP
Ok at least I know it does work. I will post the debug tommorrow. But in the mean time can you confirm what the exact attribute you have in your rad reply table is? ----- Original Message ----- From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, January 27, 2009 5:59 PM Subject: Re: rlm_sql ignoring fall-through attripute in radreply
We have set read_groups = no in the sql.conf file
Then no matter what we have fall-through attribute set to in radreply table in sql in nver even queries the group reply table.
It works for me. Post the debug for the same user with read_groups set to yes and set to no.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Fall-Through (yes and Yes work; checked just in case). Ivan Kalik Kalik Informatika ISP Dana 28/1/2009, "Mark Jones" <mjones@mnsi.net> piše:
Ok at least I know it does work.
I will post the debug tommorrow.
But in the mean time can you confirm what the exact attribute you have in your rad reply table is? ----- Original Message ----- From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, January 27, 2009 5:59 PM Subject: Re: rlm_sql ignoring fall-through attripute in radreply
We have set read_groups = no in the sql.conf file
Then no matter what we have fall-through attribute set to in radreply table in sql in nver even queries the group reply table.
It works for me. Post the debug for the same user with read_groups set to yes and set to no.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok low and behold it works this morning. Just to clarify that I am understanding things correctly. if you have read_groups = no you can overide it with the fall-through attribute if you have read_groups = yes you can not overide it with the fall-through attribute. ----- Original Message ----- From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, January 28, 2009 5:28 AM Subject: Re: rlm_sql ignoring fall-through attripute in radreply Fall-Through (yes and Yes work; checked just in case). Ivan Kalik Kalik Informatika ISP Dana 28/1/2009, "Mark Jones" <mjones@mnsi.net> piše:
Ok at least I know it does work.
I will post the debug tommorrow.
But in the mean time can you confirm what the exact attribute you have in your rad reply table is? ----- Original Message ----- From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, January 27, 2009 5:59 PM Subject: Re: rlm_sql ignoring fall-through attripute in radreply
We have set read_groups = no in the sql.conf file
Then no matter what we have fall-through attribute set to in radreply table in sql in nver even queries the group reply table.
It works for me. Post the debug for the same user with read_groups set to yes and set to no.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Just to clarify that I am understanding things correctly.
if you have read_groups = no you can overide it with the fall-through attribute
Yes.
if you have read_groups = yes you can not overide it with the fall-through attribute.
It will have no effect. Ivan Kalik Kalik Informatika ISP
To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows:
authenticate { .... Autz-Type SQL_EXAMPLE2 { sql_example2 } .... }
Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section.
What would be the way to configure accounting for the different realms in their correct databases?
Read dictionary.freeradius.internal when you are looking for server attributes. You want Acct-Type. In 2.x you don't need attribute - you use unlag to switch. Ivan Kalik Kalik Informatika ISP
Thanks Ivan, That works just fine. On Wed, Jan 28, 2009 at 12:24 AM, <tnt@kalik.net> wrote:
To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows:
authenticate { .... Autz-Type SQL_EXAMPLE2 { sql_example2 } .... }
Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section.
What would be the way to configure accounting for the different realms in their correct databases?
Read dictionary.freeradius.internal when you are looking for server attributes. You want Acct-Type. In 2.x you don't need attribute - you use unlag to switch.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hey Ivan, Further question regarding the use of realms - do sql counters require a special handling when used in conjunction with realms? Autz-Type SQL_EXAMPLE { sql_example noresetcounter datacounterdaily } What I'm seeing in debug mode is that while there's a reference to the module (the sql counter) the query itself is never ran against the database which is why I'm seeing that radius_xlat returns null. Regards, Liran. On Wed, Jan 28, 2009 at 12:24 AM, <tnt@kalik.net> wrote:
To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows:
authenticate { .... Autz-Type SQL_EXAMPLE2 { sql_example2 } .... }
Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section.
What would be the way to configure accounting for the different realms in their correct databases?
Read dictionary.freeradius.internal when you are looking for server attributes. You want Acct-Type. In 2.x you don't need attribute - you use unlag to switch.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
liran tal -
Mark Jones -
tnt＠kalik.net