Profile-Name attribute
Hi, I came across an attribute called "Profile-Name", with an encoding of 1039 (string), from an old Merit RADIUS dictionary. I see this isn't defined in the v2.2 FreeRADIUS internal dictionary, though there is a gap in the numbering where it would be. If I understand it correctly, it looks like one could have a "profiles" file with individual named profiles defined containing NAS-specific text that would be sent back to the NAS as is upon successful authentication. Is anything like this still supported? Can the "User-Profile" attribute be used in a similar way? Thanks. -John -- John Center Villanova University
John Center wrote:
Hi,
I came across an attribute called "Profile-Name", with an encoding of 1039 (string), from an old Merit RADIUS dictionary.
This means it's *not* a RADIUS attribute. i.e. it can't ever go into a RADIUS packet.
I see this isn't defined in the v2.2 FreeRADIUS internal dictionary, though there is a gap in the numbering where it would be. If I understand it correctly, it looks like one could have a "profiles" file with individual named profiles defined containing NAS-specific text that would be sent back to the NAS as is upon successful authentication. Is anything like this still supported? Can the "User-Profile" attribute be used in a similar way?
I'm not sure what Merit meant by "profiles". So no, FreeRADIUS doesn't do that. There are FreeRADIUS ways of defining profiles. You *can* do NAS-specific rules. See recent messages on this list. Alan DeKok.
Hi Alan, On 04/17/2013 05:50 PM, Alan DeKok wrote:
John Center wrote:
I see this isn't defined in the v2.2 FreeRADIUS internal dictionary, though there is a gap in the numbering where it would be. If I understand it correctly, it looks like one could have a "profiles" file with individual named profiles defined containing NAS-specific text that would be sent back to the NAS as is upon successful authentication. Is anything like this still supported? Can the "User-Profile" attribute be used in a similar way?
I'm not sure what Merit meant by "profiles". So no, FreeRADIUS doesn't do that.
It looks like it was just a way to pass back a relatively large block of text that had some significance to the NAS, but was opaque to the RADIUS server.
There are FreeRADIUS ways of defining profiles. You *can* do NAS-specific rules. See recent messages on this list.
Thanks for the pointer, I guess my timing was good. :-) -John -- John Center Villanova University
On Wed, Apr 17, 2013 at 05:04:11PM -0400, John Center wrote:
it correctly, it looks like one could have a "profiles" file with individual named profiles defined containing NAS-specific text that would be sent back to the NAS as is upon successful authentication. Is anything like this still supported? Can the "User-Profile"
There are many ways of sending attributes back based on incoming attributes (such as which NAS the request came from). One way would be to just use an instantiation of the files module that keys off the NAS-IP-Address: files nasprofile { key = "%{NAS-IP-Address}" usersfile = ${confdir}/nas-profile ... } in the "nas-profile" file: 10.0.0.1 Reply-Message := "Welcome to NAS 1" 10.0.0.2 Reply-Message := "Welcome to NAS 2" then call "nasprofile" in your sites-enabled/default authorize section. ...or use one of the other multitude of methods just discussed in the Idle-Timeout thread :-) Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, On 04/17/2013 05:53 PM, Matthew Newton wrote:
On Wed, Apr 17, 2013 at 05:04:11PM -0400, John Center wrote:
it correctly, it looks like one could have a "profiles" file with individual named profiles defined containing NAS-specific text that would be sent back to the NAS as is upon successful authentication. Is anything like this still supported? Can the "User-Profile"
There are many ways of sending attributes back based on incoming attributes (such as which NAS the request came from). One way would be to just use an instantiation of the files module that keys off the NAS-IP-Address:
files nasprofile { key = "%{NAS-IP-Address}" usersfile = ${confdir}/nas-profile ... }
in the "nas-profile" file:
10.0.0.1 Reply-Message := "Welcome to NAS 1"
10.0.0.2 Reply-Message := "Welcome to NAS 2"
then call "nasprofile" in your sites-enabled/default authorize section.
...or use one of the other multitude of methods just discussed in the Idle-Timeout thread :-)
Matthew
It was just serendipity that I asked this question at the right time! I'll check this out & the Idle-timeout thread. Seems like a good topic for the Wiki... Thanks. -John -- John Center Villanova University
participants (3)
-
Alan DeKok -
John Center -
Matthew Newton