Hi, all. First, let me say that if the answer to this is in the lists or the docs or rlm_whatever.c, please let me know. I've been searching for a few days, but either I'm not using the right queries to find my answer, or it's not there. (Ain't that always the way?) :-) We recently upgraded from a hacked-n-patched in-house version of FR 0.8.1 to the release version 1.0.5 (which currently has almost all the hacks we needed, and we decided to do without the single one that it doesn't). All configuration files are the same with the exception that we're using the new dictionary. We also use the MegaPOP visp dialup thingy, where users dial into a MegaPOP number as "Login@ourdomain.com" and get proxied to our radius servers for authentication. The problem is that with FR 0.8.1, our custom Radius attributes were getting sent back to the proxy and applied to the user. As soon as we implemented 1.0.5, this does not happen and all users are assigned a generic PPP profile regardless of what we have for them here. I would have just bugged the MegaPOP folks (and, indeed, I've done so and now I'm waiting on an email from them to see if they have any ideas), but since it's pretty clearly something that changed between 0.8.1 and 1.0.5, I thought I'd see if anyone here could point me in the right direction. Anyway, any ideas or pointers to docs/code appreciated. Thanks! Kristina
Kristina Pfaff-Harris <kristina@greatbasin.net> wrote:
The problem is that with FR 0.8.1, our custom Radius attributes were getting sent back to the proxy and applied to the user. As soon as we implemented 1.0.5, this does not happen and all users are assigned a generic PPP profile regardless of what we have for them here.
Are the attributes being received by the proxy? If so, which module is deleting them? Debug mode should tell you more... Alan DeKok.
On Fri, 11 Nov 2005, Alan DeKok wrote:
Are the attributes being received by the proxy? If so, which module is deleting them?
Debug mode should tell you more...
Hrm. Good question. I guess I assumed they were since they were before. I'll see if I can get with the MegaPOP folks and find out. Pretty sure I'm sending them, but I've been going back and forth so much with debugging different things the last couple of days, I'll need to check that again. Thanks. I may be back with more questions once I narrow it down a bit more. :-) Kristina
On Fri, 11 Nov 2005, Alan DeKok wrote:
Are the attributes being received by the proxy? If so, which module is deleting them?
Debug mode should tell you more...
Okey doke. I dunno why I didn't see this before, but I did some more testing in debug mode and found that User@realm was not returning the attributes I thought it should, whereas just plain "User" was. I double-checked the attrs file, and it looked like the problem was that I was expecting, e.g. "Login-Host" where, instead, I was getting "Login-IP-Host." Since we are using the new dictionary with 1.0.5, I really should have thought of differences in dictionary names for attributes. One problem that I haven't figured out yet, is this: after I worked out the name thing and put "Login-IP-Host" in attrs, I did have it set to the same IP as the radius profile, but the attribute still did not go through. I ended up doing "Login-IP-Host =* ANY" which I'm not totally thrilled with, but which probably isn't going to hurt much. So. Possibly a minor bug in rlm_attr_filter that's not recognizing it when I put in the actual IP, or a bug in the documentation not mentioning special circumstances for IP addresses and Login-IP-Host, or a bug in my thinking not understanding the documentation? Any ideas? Also, I didn't see anything in doc/rlm_attr_filter about this but maybe there could be a note in there saying something like "If you have attributes in the attrs file and they are still getting filtered, double-check the attribute names in your current dictionary. E.g. what you expect to be Login-Host may be Login-IP-Host and Service-Type may be User-Service-Type or User-Service." Um ... that is if I'm not completely off base about why it wasn't working before. :-) Thanks again for the suggestion to try debug mode again, Alan. Dang it, I swear I did, but I just didn't see it before. Kristina
participants (2)
-
Alan DeKok -
Kristina Pfaff-Harris