Expand Ldap Attribute on Post-Auth section
Hello there, I'm trying to evaluate an ldap returned attribute on the post-auth section. At my dictionary: ATTRIBUTE Aa 3000 string At my ldap.attrmap: checkItem AA eduPersonAffiliation And at my custom module: exec aloca_vlans { wait = yes program = "/usr/local/bin/script-teste.sh %{User-Name} %{control:Aa} %{reply:Aa} %{Aa} " input_pairs = request output_pairs = reply packet_type = Access-Accept shell_escape = yes } When running radiusd -X, I see the data getting fetched. [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] eduPersonAffiliation -> Aa == "5" [ldap] eduPersonAffiliation -> Aa == "2" [ldap] userPassword -> Password-With-Header == "xxxxxxxxxxxxx" [ldap] ntPassword -> NT-Password == xxxxxxxxxxxxxx [ldap] looking for reply items in directory... But when the variables are expanded it returns nothing: # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/xxxxxx/reply-detail-20110606 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/xxxxxx/reply-detail-20110606 [reply_log] expand: %t -> Mon Jun 6 15:04:10 2011 ++[reply_log] returns ok [aloca_vlans] expand: %{User-Name} -> renan.manola [aloca_vlans] expand: %{control:Aa} -> [aloca_vlans] expand: %{reply:Aa} -> [aloca_vlans] expand: %{Aa} -> I have specified the control and reply lists just as a test. If I don't specify the variable name at the dictionary file, the log complains of "unknown module not found". Best regards. -- Renan Manola Analista de Tecnologia da Informação Nucleo de Processamento de Dados (NPD) Universidade Federal do Espírito Santo (UFES) Ministério da Educação - Serviço Público Federal E-mail: rmanola@npd.ufes.br Antes de imprimir pense em seu compromisso com o Meio Ambiente. As informações existentes nesta mensagem e em seus arquivos anexados são para uso restrito, sendo seu sigilo protegido por lei. Caso você não seja o destinatário, saiba que leitura, divulgação ou cópia são proibidas. Neste caso, favor notificar o remetente e apagar as informações. O uso impróprio destas informações será tratado conforme as normas da empresa e a legislação em vigor.
So, according to this: http://wiki.freeradius.org/Attribute%20support%20by%20processing%20list I can only access the User-Name and Auth-Type at my custom exec module, and nothing else? I just want to access an LDAP value at my exec module without having to issue an external ldapsearch and avoid mantaining doubled ldap configurations and queries for this. Em 06-06-2011 15:13, Renan escreveu:
Hello there,
I'm trying to evaluate an ldap returned attribute on the post-auth section.
At my dictionary: ATTRIBUTE Aa 3000 string
At my ldap.attrmap: checkItem AA eduPersonAffiliation
And at my custom module: exec aloca_vlans { wait = yes program = "/usr/local/bin/script-teste.sh %{User-Name} %{control:Aa} %{reply:Aa} %{Aa} " input_pairs = request output_pairs = reply packet_type = Access-Accept shell_escape = yes }
When running radiusd -X, I see the data getting fetched.
[ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] eduPersonAffiliation -> Aa == "5" [ldap] eduPersonAffiliation -> Aa == "2" [ldap] userPassword -> Password-With-Header == "xxxxxxxxxxxxx" [ldap] ntPassword -> NT-Password == xxxxxxxxxxxxxx [ldap] looking for reply items in directory...
But when the variables are expanded it returns nothing:
# Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/xxxxxx/reply-detail-20110606 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/xxxxxx/reply-detail-20110606 [reply_log] expand: %t -> Mon Jun 6 15:04:10 2011 ++[reply_log] returns ok [aloca_vlans] expand: %{User-Name} -> renan.manola [aloca_vlans] expand: %{control:Aa} -> [aloca_vlans] expand: %{reply:Aa} -> [aloca_vlans] expand: %{Aa} ->
I have specified the control and reply lists just as a test. If I don't specify the variable name at the dictionary file, the log complains of "unknown module not found".
Best regards.
-- Renan Manola Analista de Tecnologia da Informação Nucleo de Processamento de Dados (NPD) Universidade Federal do Espírito Santo (UFES) Ministério da Educação - Serviço Público Federal E-mail: rmanola@npd.ufes.br Antes de imprimir pense em seu compromisso com o Meio Ambiente. As informações existentes nesta mensagem e em seus arquivos anexados são para uso restrito, sendo seu sigilo protegido por lei. Caso você não seja o destinatário, saiba que leitura, divulgação ou cópia são proibidas. Neste caso, favor notificar o remetente e apagar as informações. O uso impróprio destas informações será tratado conforme as normas da empresa e a legislação em vigor.
Renan wrote:
So, according to this: http://wiki.freeradius.org/Attribute%20support%20by%20processing%20list
I can only access the User-Name and Auth-Type at my custom exec module, and nothing else?
Uh, no. The wiki page needs to be reformatted. Each module has access to *all* of the attributes in *all* of the lists. Which attributes actually exist depend on the packet, and on the local configuration.
I just want to access an LDAP value at my exec module without having to issue an external ldapsearch and avoid mantaining doubled ldap configurations and queries for this.
You can't use RADIUS to query LDAP from an "exec" module. Alan DeKok.
Hi Alan, On 06/07/2011 01:30 PM, Alan DeKok wrote:
Renan wrote:
So, according to this: http://wiki.freeradius.org/Attribute%20support%20by%20processing%20list
I can only access the User-Name and Auth-Type at my custom exec module, and nothing else?
Uh, no. The wiki page needs to be reformatted.
We talked about this, there isn't any more content there. Someone needs to rewrite this page. -John -- John Center Villanova University
On 06/07/2011 02:22 PM, Alan DeKok wrote:
John Center wrote:
We talked about this, there isn't any more content there. Someone needs to rewrite this page.
mediawiki.freeradius.org should now work. The contents can be copied from there.
Still no more content, see http://mediawiki.freeradius.org/Attribute_support_by_processing_list. Either whoever wrote this page stopped without finishing it, or the bulk of the previous content was lost. :-( -John
On Jun 7, 2011, at 1:07 PM, John Center wrote:
On 06/07/2011 02:22 PM, Alan DeKok wrote:
John Center wrote:
We talked about this, there isn't any more content there. Someone needs to rewrite this page.
mediawiki.freeradius.org should now work. The contents can be copied from there.
Nice work. Now we can verify whether things were actually lost or just never existed int he first place.
Still no more content, see http://mediawiki.freeradius.org/Attribute_support_by_processing_list. Either whoever wrote this page stopped without finishing it, or the bulk of the previous content was lost. :-(
Stopped without finishing it looks like. Revision history goes back to 2006 and it never had any more content than it does now... -Arran Arran Cudbard-Bell RM-RF Limited - Security consultation and contracting VoIP: +1 916-436-1352 Cell: +44 7854041841
Em 07-06-2011 14:30, Alan DeKok escreveu:
You can't use RADIUS to query LDAP from an "exec" module. It's not a query per say, I would be acessing a variable that was already **set** by the LDAP module (That's why I specified it at ldap.attrmap).
Each module has access to*all* of the attributes in*all* of the lists. Which attributes actually exist depend on the packet, and on the local configuration. So all of the attributes are available except the ones that Ldap module fetched (for example: NT-Password, Password-With-Header, my custom defined: Aa, etc...). As a test, at my exec module I did: "env >> /tmp/temp_file.txt" to see wich variables are exported, here is the result: CALLED_STATION_ID="..." CALLING_STATION_ID="..." SERVICE_TYPE=Login-User EAP_TYPE=PEAP NAS_PORT=1371 NAS_IDENTIFIER="..." NAS_PORT_TYPE=Wireless-802.11 MESSAGE_AUTHENTICATOR=0xb... USER_NAME="renan.manola" STATE=0x01.... EAP_MESSAGE=0x0... FRAMED_MTU=1400 PWD=/etc/freeradius NAS_IP_ADDRESS=.... SHLVL=1 NAS_PORT_ID="1371" Is that the normal behavior or was it supposed to return more variables? My module is called at the post-auth section. Regards. -- Renan Manola Analista de Tecnologia da Informação Nucleo de Processamento de Dados (NPD) Universidade Federal do Espírito Santo (UFES) Ministério da Educação - Serviço Público Federal E-mail: rmanola@npd.ufes.br Antes de imprimir pense em seu compromisso com o Meio Ambiente. As informações existentes nesta mensagem e em seus arquivos anexados são para uso restrito, sendo seu sigilo protegido por lei. Caso você não seja o destinatário, saiba que leitura, divulgação ou cópia são proibidas. Neste caso, favor notificar o remetente e apagar as informações. O uso impróprio destas informações será tratado conforme as normas da empresa e a legislação em vigor.
Renan wrote:
So all of the attributes are available except the ones that Ldap module fetched (for example: NT-Password, Password-With-Header, my custom defined: Aa, etc...). As a test, at my exec module I did: "env >> /tmp/temp_file.txt" to see wich variables are exported, here is the result:
Come on... *read* the documentation. An exec'd program gets passed a limited subset of attributes. A *module* gets passed all of the attributes. See rlm_example for a sample C module. If you want access to multiple attribute lists, use (a) rlm_perl, or (b) a C module. Alan DeKok.
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
John Center -
Renan