Hello, i guess i need to do the following. I have a freeradius which proxies requests to two destinations -- one destination for packets with certain Called-Station-Id, and one default destination. And i wish to select some requests by other criteria (other than Called-Station-Id), which may change in general case. So, when some conditions occur, i need freeradius to proxy such a request to first, specific destination (not "default" one). So, something like this works in general case: users: --------------------- DEFAULT Called-Station-Id == "OKLMNPQ", Proxy-To-Realm := "specific" DEFAULT Proxy-To-Realm := "default" ---------------------------- I have tried to write a python module, which -- if those "specific" conditions occur -- updates User-Name (adds realm "@specific" to username) and sets (('Autz-Type', 'Specific'),) in return tuple and changed authorize section like this: radiusd.conf: -------------- authorize { ... files Autz-Type Specific { # to look into "users" once again: files } } ---------------------------- and users like this: users: --------------------- DEFAULT User-Name =~ "@specific", Proxy-To-Realm := "specific" ... ---------------------------- ... but this doesnt work as expected. I can see in "-X" output that my module changes User-Name, but this doesnt work however. So, how can i perform this? In a case when i need to write a module to catch those specific criteria? Can i set and use Autz-Type for this? I am not sure that i will use this in production, but would like to finish as an exercise at least, anyway. I have FreeRADIUS 1.1.7 with rlm_python. Thank you very much, -- Dmytro O. Redchuk
Dmytro O. Redchuk wrote:
So, when some conditions occur, i need freeradius to proxy such a request to first, specific destination (not "default" one).
That should be relatively easy.
So, something like this works in general case: users: --------------------- DEFAULT Called-Station-Id == "OKLMNPQ", Proxy-To-Realm := "specific" DEFAULT Proxy-To-Realm := "default" ----------------------------
Yes. Or, in 2.0, use "unlang". It's ever so much easier...
I have tried to write a python module, which -- if those "specific" conditions occur -- updates User-Name (adds realm "@specific" to username) and sets (('Autz-Type', 'Specific'),) in return tuple and changed authorize section like this:
You generally don't need to write scripts for these decisions in 2.0.
I have FreeRADIUS 1.1.7 with rlm_python.
I suggest upgrading to 2.0.3. It has a large number of bugs fixed over 1.1.7, and is generally compatible with the 1.1.7 configuration files. Alan DeKok.
On Tue, Mar 18, 2008 at 02:36:25AM +0100, Alan DeKok wrote:
Dmytro O. Redchuk wrote:
So, when some conditions occur, i need freeradius to proxy such a request to first, specific destination (not "default" one).
That should be relatively easy.
I have got working config for authorization in like this way: -- radiusd.conf: --------------------- modules { ... files files_default { # ... as default -- acct_users etc } files files_specific { # ... acct_users.specific etc } # this python "module" sets Autz-Type to "Specific" # if some conditions occur: python my_py_specific { # ... } ... } authorize { preprocess my_py_specific files_default Autz-Type Specific { files_specific } } -------------------------------------- -- users: ---------------------------- DEFAULT Called-Station-Id == "KLMNOPQ", Proxy-To-Realm := "specific" DEFAULT Proxy-To-Realm := "DEFAULT" -------------------------------------- -- users.specific: ------------------- DEFAULT Proxy-To-Realm := "specific" -------------------------------------- This works for authorization, but i could not get it working for accounting, i dont know why. ("pre-acct {my_py_specific}" and then Acct-Type in "accounting {...}, right?) But my question now is: is this "right way"? How i could do this better?
I have FreeRADIUS 1.1.7 with rlm_python.
I suggest upgrading to 2.0.3. It has a large number of bugs fixed over 1.1.7, and is generally compatible with the 1.1.7 configuration files. Tried to rebuild and will try (and possibly ask,) of course. I have to use rpm builds only on that server.
Thank you.
Alan DeKok.
-- Dmytro O. Redchuk (+380) 44 2474832
participants (2)
-
Alan DeKok -
Dmytro O. Redchuk