hello, I have enabled the mac authentication in my system, so when the user is connected to the wifi Mikrotik will send a mac address as a username, I am checking if the username is a mac address I am getting the username that belongs to that mac and do the rest of the authentication against the username(not the MAc) so if the user has rights access to the internet I am sending accept but Mikrotik saved the username as a mac address, I tried to reply with the attribute: User-Name="user" but it seems not working are there any attributes or something that I can do that Thanks in Advance
On Mar 17, 2022, at 10:58 AM, Muhammed Buvaydani via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
so when the user is connected to the wifi Mikrotik will send a mac address as a username, I am checking if the username is a mac address I am getting the username that belongs to that mac and do the rest of the authentication against the username(not the MAc)
so if the user has rights access to the internet I am sending accept
That's good.
but Mikrotik saved the username as a mac address, I tried to reply with the attribute: User-Name="user"
but it seems not working
are there any attributes or something that I can do that
No. If the Mikrotik ignores the User-Name in the Access-Accept, there isn't much you can do. Just do the MAC to User-Name lookup again when the server receives accounting packets. Alan DeKok.
Thanks for replying actually ı am returning the mac to the username in accounting packet but i want to do that for disconnect packet instead of sending disconnect packet to the mac i wanted tosend disconnect for username. Because ı have username auth and ip auth and mac auth On Thu, Mar 17, 2022, 6:57 PM Alan DeKok <aland@deployingradius.com> wrote:
On Mar 17, 2022, at 10:58 AM, Muhammed Buvaydani via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
so when the user is connected to the wifi Mikrotik will send a mac address as a username, I am checking if the username is a mac address I am getting the username that belongs to that mac and do the rest of the authentication against the username(not the MAc)
so if the user has rights access to the internet I am sending accept
That's good.
but Mikrotik saved the username as a mac address, I tried to reply with the attribute: User-Name="user"
but it seems not working
are there any attributes or something that I can do that
No.
If the Mikrotik ignores the User-Name in the Access-Accept, there isn't much you can do. Just do the MAC to User-Name lookup again when the server receives accounting packets.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
mohamad buvaydanı <starking123eng@gmail.com> writes:
Thanks for replying actually ı am returning the mac to the username in accounting packet but i want to do that for disconnect packet instead of sending disconnect packet to the mac i wanted tosend disconnect for username. Because ı have username auth and ip auth and mac auth
The radius server has all the info, Send the disconnect request there instead of directly to the NAS, and let the radius server translate the username into whatever session attributes the Mikrotik wants. raddb/sites-available/coa-relay example is a good place to start. Bjørn
On Mar 17, 2022, at 1:39 PM, mohamad buvaydanı <starking123eng@gmail.com> wrote:
Thanks for replying actually ı am returning the mac to the username in accounting packet but i want to do that for disconnect packet instead of sending disconnect packet to the mac i wanted tosend disconnect for username.
That's not how RADIUS works. If the session has the MAC for a User-Name, then CoA / disconnect packet MUST have the same MAC in the User-Name. You can store the MAC in the DB, associated with the User-Name. Then, if you want to kick off user "bob", look "bob" up in the DB to get the MAC, and then send the RADIUS CoA packet with the MAC in the User-Name. Alan DeKok.
participants (4)
-
Alan DeKok -
Bjørn Mork -
mohamad buvaydanı -
Muhammed Buvaydani