What is the recommended way of overriding a mod file like "realm"
The reason I am asking is because domain logins are appearing as "user/machine.domain". I can make it work by adding a realm in proxy.conf (or a parallel file and adding an INCLUDE in radius.conf): realm "~(.*\.)*domain$" { } But I also either have to change the delimiter in the "realm suffix" section of /etc/raddb/mods-available/realm from "@" to "/" which means the file is non non-standard or I have a couple of choices of adding a block: realm realmclearos { format = suffix delimiter = "/" } at the bottom /etc/raddb/mods-available/realm or in its own file in mods-available and symlinking to it from mods-enabled, but then, either way, I also have to add a line "realmclearos" in /etc/raddb/sites-available/default around the line saying "suffix" which makes /etc/raddb/sites-available/default non-standard. There is a fair push on the mailing lists of keeping things standard and I am wondering what is the best direction - or is my solution completely wrong. Thanks, Nick
On Thu, 2018-04-26 at 14:08 +0100, Nick Howitt wrote:
or I have a couple of choices of adding a block:
realm realmclearos { format = suffix delimiter = "/" }
at the bottom /etc/raddb/mods-available/realm or in its own file in mods-available and symlinking to it from mods-enabled
This looks tidier to me.
There is a fair push on the mailing lists of keeping things standard and I am wondering what is the best direction - or is my solution completely wrong.
Well... there's keeping things standard, and there's making the config work. No point leaving the config "as-is" if it doesn't work for you. That's the whole point; you can change it. The thing is, don't change things that don't need changing. 99% of the default config will work for everyone, so there's no need to try and tweak it unless it's needed. So, if both of the above work for you, use whichever of the two methods you're happiest with yourself. Then check them into git or whatever so you know what you've changed from the default. You could also just comment out the "realm" call and use unlang instead, if you wanted. -- Matthew
participants (2)
-
Matthew Newton -
Nick Howitt