Auth by NAS-Identifier using unlang
I was thinking this should be easy, but it's been two weeks and I give up... This is what I want to do: My NAS, (a WiFi AP), has two SSIDs: "staff" and "guests". I want mutual exclusivity. My /etc/raddb/users file contains something like this: abc Cleartext-Password:="xyz" Local-Group="staff" I've created an attribute in my /etc/raddb/dictionary file: ATTRIBUTE Local-Group 3000 string In my /etc/raddb/sites-enabled/default file, in the authorize section, I've got this: if ( Local-Group != NAS-Identifier ) { update reply { Reply-Message := "You may not connect to %{NAS-Identifier} AP.\r\n" } reject } My access request looks something like this: (edited for brevity.) User-Name = "abc" NAS-IP-Address = 192.168.8.253 NAS-Port = 0 NAS-Identifier = "guests" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "..." Called-Station-Id = "..." Service-Type = Login-User Framed-MTU = 1100 EAP-Message =... State = ... Aruba-Essid-Name = "test" Aruba-Location-Id = "wifi" Aruba-AP-Group = "Our WiFi" Running radiusd -X I get: : ++? if (Local-Group != NAS-Identifier ) (Attribute Local-Group was not found) ? Evaluating (Local-Group != NAS-Identifier ) -> FALSE ++? if (Local-Group != NAS-Identifier ) -> FALSE : And it's clear Local-Group is always empty. :-( Some things I've tried: -Moved code to post-auth section instead of authorize. -Different attributes instead of private dictionary. (i.e. Group-Name) -Running an executable, (actually works, but selinux appears to be a problem?) -Changing the test from != to == makes things work as expected, so if the comparison will actually work, I'm good. I'm clearly not understanding something.... -Joseph
Running radiusd -X I get:
: ++? if (Local-Group != NAS-Identifier ) (Attribute Local-Group was not found) ? Evaluating (Local-Group != NAS-Identifier ) -> FALSE ++? if (Local-Group != NAS-Identifier ) -> FALSE :
And it's clear Local-Group is always empty. :-(
Yeah you've inserted it into the reply list, and you're looking for it in the request list.... abc Cleartext-Password:="xyz", Local-Group := 'NAS-Identifier' if (control:Local-Group != 'NAS-Identifier') -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Changing the Local-Group into the request still makes control:Local-Group empty. abc Cleartext-Password:="xyz", Local-Group:="staff" NAS Sends this: User-Name = "abc" : NAS-Identifier = "resident" if ( control:Local-Group != NAS-Identifier ) { Diagnostic says: ++? if (control:Local-Group != NAS-Identifier ) -> FALSE ("staff" != "resident") should be True, but control:Local-Group is empty. :-( On Mon, Aug 5, 2013 at 4:14 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
Running radiusd -X I get:
: ++? if (Local-Group != NAS-Identifier ) (Attribute Local-Group was not found) ? Evaluating (Local-Group != NAS-Identifier ) -> FALSE ++? if (Local-Group != NAS-Identifier ) -> FALSE :
And it's clear Local-Group is always empty. :-(
Yeah you've inserted it into the reply list, and you're looking for it in the request list....
abc Cleartext-Password:="xyz", Local-Group := 'NAS-Identifier'
if (control:Local-Group != 'NAS-Identifier')
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Diagnostic says: ++? if (control:Local-Group != NAS-Identifier ) -> FALSE
Assuming you're not looking for a literal value 'NAS-Identifier', you want "%{NAS-Identifier}". If this is a new deployment you should use current HEAD revision in Master. Then you can use the debug_attr expansion to look at list state. update request { Tmp-String-0 := "%{debug_attr:control:}" } Also could you please stop posting snippets of debug output and paste the whole thing... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
The following appears to now work, but I don't understand some things: files if (control:Local-Group != "%{NAS-Identifier}" ) { Why does control:Local-Group not need to be enclosed in "%{ }", but NAS-Identifier does? And why does %{ } content need to be within quotes, when the documentation doesn't say anything about them needing to be in quotes? It's clear I must have a call to "files" prior to this in order to populate the "control" list, right? On Mon, Aug 5, 2013 at 5:03 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
Diagnostic says: ++? if (control:Local-Group != NAS-Identifier ) -> FALSE
Assuming you're not looking for a literal value 'NAS-Identifier', you want "%{NAS-Identifier}".
If this is a new deployment you should use current HEAD revision in Master. Then you can use the debug_attr expansion to look at list state.
update request { Tmp-String-0 := "%{debug_attr:control:}" }
Also could you please stop posting snippets of debug output and paste the whole thing...
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 5 Aug 2013, at 22:37, Joseph Perrin <joseph@lifeonthestreet.org> wrote:
The following appears to now work, but I don't understand some things:
files
if (control:Local-Group != "%{NAS-Identifier}" ) {
Why does control:Local-Group not need to be enclosed in "%{ }", but NAS-Identifier does?
In 2.x.x bareword left operand is assumed to be an attribute reference. Right bareword operand is assumed to be a number literal, or a member of the set of string values associated with an integer attribute. LHS/RHS operands are not interchangeable in their roles.
And why does %{ } content need to be within quotes
It's a string expansion, string expansions only function inside double quotes. This is similar to variable expansion in most scripting languages.
, when the documentation doesn't say anything about them needing to be in quotes?
Man unlang VARIABLES Run-time variables are referenced using the following syntax %{Variable-Name} Note that unlike C, there is no way to declare variables, or to refer to them outside of a string context. All references to variables MUST be contained inside of a double-quoted or back-quoted string."
It's clear I must have a call to "files" prior to this in order to populate the "control" list, right?
Yes. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Thank you. I now understand. A stock install of freeRadius in Fedora, (i.e. via yum), does not provide a man page for unlang. Had you not helped me, I'd simply not know. On Mon, Aug 5, 2013 at 6:00 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 5 Aug 2013, at 22:37, Joseph Perrin <joseph@lifeonthestreet.org> wrote:
The following appears to now work, but I don't understand some things:
files
if (control:Local-Group != "%{NAS-Identifier}" ) {
Why does control:Local-Group not need to be enclosed in "%{ }", but NAS-Identifier does?
In 2.x.x bareword left operand is assumed to be an attribute reference. Right bareword operand is assumed to be a number literal, or a member of the set of string values associated with an integer attribute.
LHS/RHS operands are not interchangeable in their roles.
And why does %{ } content need to be within quotes
It's a string expansion, string expansions only function inside double quotes. This is similar to variable expansion in most scripting languages.
, when the documentation doesn't say anything about them needing to be in quotes?
Man unlang
VARIABLES Run-time variables are referenced using the following syntax
%{Variable-Name}
Note that unlike C, there is no way to declare variables, or to refer to them outside of a string context. All references to variables MUST be contained inside of a double-quoted or back-quoted string."
It's clear I must have a call to "files" prior to this in order to populate the "control" list, right?
Yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 08/05/2013 08:49 PM, Joseph Perrin wrote:
Thank you. I now understand.
A stock install of freeRadius in Fedora, (i.e. via yum), does not provide a man page for unlang. Had you not helped me, I'd simply not know.
Nonsense, the freeradius rpm installs the unlang man page. Please provide the exact installed rpm if you think otherwise. -- John
Hi,
I was thinking this should be easy, but it's been two weeks and I give up...
well, depends how you do it....if you do it easy it is easy, no? users file abc Cleartext-Password := "xyz", NAS-Identifier = "staff" Reply-Message "Welcome on-board staff member" dont forget, if this is 802.1X etc then your users wont see the reply-message...so dont rely on it for telling them things! alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
John Dennis -
Joseph Perrin