rlm_rest JSON format for multiple attributes
Hi Guys I've ran into a problem with rlm_rest and specifying VPs with JSON. I need to return multiple Framed-Route attributes. So now I have : {'Framed-Route':'1.2.3.4/32'} I can't add any additional Framed-Route attributes because the JSON format is a set of key value pairs and the key is unique.
From RFC4627:
An object structure is represented as a pair of curly brackets surrounding zero or more name/value pairs (or members). A name is a string. A single colon comes after each name, separating the name from the value. A single comma separates a value from a following name. *The names within an object SHOULD be unique.---------------* Is there a way to support an array of values? eg. {'Framed-Route':['1.2.3.4/32','5.6.7.8/32']} Thank you Werner Stucky
On 24 Mar 2014, at 18:44, Werner Stucky <wernerml@stucky-solutions.net> wrote:
Hi Guys
I've ran into a problem with rlm_rest and specifying VPs with JSON. I need to return multiple Framed-Route attributes.
So now I have :
{'Framed-Route':'1.2.3.4/32'}
I can't add any additional Framed-Route attributes because the JSON format is a set of key value pairs and the key is unique.
From RFC4627: --------------- An object structure is represented as a pair of curly brackets surrounding zero or more name/value pairs (or members). A name is a string. A single colon comes after each name, separating the name from the value. A single comma separates a value from a following name. The names within an object SHOULD be unique. ---------------
Is there a way to support an array of values?
eg.
{'Framed-Route':['1.2.3.4/32','5.6.7.8/32']}
git pull Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi Arran Its not encoding the Access-Request attributes anymore. I don't get any encoded attributes in the HTTP request to my REST service. The service responds with a 401 because it does not receive any data in the query. Ready to process requests rad_recv: Access-Request packet from host 192.168.118.102 port 40369, id=129, length=94 User-Name = '4448' CHAP-Password = 0x9b9573452e490326d7fc9cf65853d81472 NAS-Port-Id = '2342232332' NAS-IP-Address = 10.10.22.11 Calling-Station-Id = '337354722' (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) authorize { (6) [preprocess] = ok (6) chap : Setting 'Auth-Type := CHAP' (6) [chap] = ok (6) [mschap] = noop (6) eap : No EAP-Message, not doing EAP (6) [eap] = noop rlm_rest (rest): Reserved connection (5) (6) rest : Expanding URI components (6) rest : EXPAND http://192.168.113.151:2233 (6) rest : --> http://192.168.113.151:2233 (6) rest : EXPAND /authorize (6) rest : --> /authorize (6) rest : Sending HTTP POST to "http://192.168.113.151:2233/authorize" (6) rest : Processing response header (6) rest : Status : 401 (Unauthorized) (6) rest : Type : json (application/json) This is how it used to show : (35) rest : expand: "http://192.168.113.151:2233" -> ' http://192.168.113.151:2233' (35) rest : expand: "/authorize" -> '/authorize' (35) rest : Sending HTTP POST to "http://192.168.113.151:2233/authorize" (35) rest : Encoding attribute "User-Name" (35) rest : Encoding attribute "CHAP-Password" (35) rest : Encoding attribute "NAS-Port-Id" (35) rest : Encoding attribute "NAS-IP-Address" (35) rest : Encoding attribute "Calling-Station-Id" (35) rest : Encoding attribute "CHAP-Challenge" Thanks Werner Stucky On 24 Mar 2014 23:19, "Arran Cudbard-Bell" <a.cudbardb@freeradius.org> wrote:
On 24 Mar 2014, at 18:44, Werner Stucky <wernerml@stucky-solutions.net> wrote:
Hi Guys
I've ran into a problem with rlm_rest and specifying VPs with JSON. I need to return multiple Framed-Route attributes.
So now I have :
{'Framed-Route':'1.2.3.4/32'}
I can't add any additional Framed-Route attributes because the JSON format is a set of key value pairs and the key is unique.
From RFC4627: --------------- An object structure is represented as a pair of curly brackets surrounding zero or more name/value pairs (or members). A name is a string. A single colon comes after each name, separating the name from the value. A single comma separates a value from a following name. The names within an object SHOULD be unique. ---------------
Is there a way to support an array of values?
eg.
{'Framed-Route':['1.2.3.4/32','5.6.7.8/32']}
git pull
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 26 Mar 2014, at 01:49, Werner Stucky <wernerml@stucky-solutions.net> wrote:
Hi Arran
Its not encoding the Access-Request attributes anymore.
Ensure you have: authorize { ... body = "json" } and your method isn't GET or DELETE. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 26 Mar 2014, at 07:21, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 26 Mar 2014, at 01:49, Werner Stucky <wernerml@stucky-solutions.net> wrote:
Hi Arran
Its not encoding the Access-Request attributes anymore.
Ensure you have:
authorize { ... body = "json" }
and your method isn't GET or DELETE.
I've added more documentation to the rest default config file if you want to update your local copy. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi Arran No requests are coming through at all with this config : authorize { uri = "${..connect_uri}/authorize" method = "post" body = "json" } The console output is : Ready to process requests rad_recv: Access-Request packet from host 192.168.118.102 port 44655, id=9, length=94 User-Name = '4448' CHAP-Password = 0x4b29d9af0b3c3097abb01df83dd6bd2559 NAS-Port-Id = '2342232332' NAS-IP-Address = 10.10.22.11 Calling-Station-Id = '337354722' (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) chap : Setting 'Auth-Type := CHAP' (0) [chap] = ok (0) [mschap] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop rlm_rest (rest): Reserved connection (2) (0) rest : Expanding URI components (0) rest : EXPAND http://192.168.113.151:2233 (0) rest : --> http://192.168.113.151:2233 (0) rest : EXPAND /authorize (0) rest : --> /authorize (0) rest : Sending HTTP POST to "http://192.168.113.151:2233/authorize" (0) rest : Encoding attribute "User-Name" (0) rest : Encoding attribute "CHAP-Password" (0) rest : Encoding attribute "NAS-IP-Address" (0) rest : Encoding attribute "Calling-Station-Id" (0) rest : Encoding attribute "CHAP-Challenge" (0) rest : Encoding attribute "NAS-Port-Id" (0) rest : Processing response header (0) rest : Status : 400 (Bad Request) (0) rest : Type : json (application/json) rlm_rest (rest): Released connection (2) (0) [rest] = invalid (0) } # authorize = invalid (0) Using Post-Auth-Type Reject If I do a curl POST request to that URI it works. No traffic coming from the server I've checked with tcpdump. Regards On Wed, Mar 26, 2014 at 9:29 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 26 Mar 2014, at 07:21, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 26 Mar 2014, at 01:49, Werner Stucky <wernerml@stucky-solutions.net>
wrote:
Hi Arran
Its not encoding the Access-Request attributes anymore.
Ensure you have:
authorize { ... body = "json" }
and your method isn't GET or DELETE.
I've added more documentation to the rest default config file if you want to update your local copy.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
body = "post" seems to be working fine I'm getting the multiple Framed-Route attributes too :) Not sure about the body = "json" Thanks On Wed, Mar 26, 2014 at 9:21 PM, Werner Stucky < wernerml@stucky-solutions.net> wrote:
Hi Arran
No requests are coming through at all with this config :
authorize { uri = "${..connect_uri}/authorize" method = "post" body = "json" }
The console output is :
Ready to process requests rad_recv: Access-Request packet from host 192.168.118.102 port 44655, id=9, length=94 User-Name = '4448' CHAP-Password = 0x4b29d9af0b3c3097abb01df83dd6bd2559
NAS-Port-Id = '2342232332' NAS-IP-Address = 10.10.22.11 Calling-Station-Id = '337354722' (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) chap : Setting 'Auth-Type := CHAP' (0) [chap] = ok (0) [mschap] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop rlm_rest (rest): Reserved connection (2) (0) rest : Expanding URI components (0) rest : EXPAND http://192.168.113.151:2233 (0) rest : --> http://192.168.113.151:2233 (0) rest : EXPAND /authorize (0) rest : --> /authorize (0) rest : Sending HTTP POST to "http://192.168.113.151:2233/authorize" (0) rest : Encoding attribute "User-Name" (0) rest : Encoding attribute "CHAP-Password" (0) rest : Encoding attribute "NAS-IP-Address" (0) rest : Encoding attribute "Calling-Station-Id" (0) rest : Encoding attribute "CHAP-Challenge" (0) rest : Encoding attribute "NAS-Port-Id" (0) rest : Processing response header (0) rest : Status : 400 (Bad Request) (0) rest : Type : json (application/json) rlm_rest (rest): Released connection (2) (0) [rest] = invalid (0) } # authorize = invalid (0) Using Post-Auth-Type Reject
If I do a curl POST request to that URI it works. No traffic coming from the server I've checked with tcpdump.
Regards
On Wed, Mar 26, 2014 at 9:29 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 26 Mar 2014, at 07:21, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 26 Mar 2014, at 01:49, Werner Stucky <wernerml@stucky-solutions.net>
wrote:
Hi Arran
Its not encoding the Access-Request attributes anymore.
Ensure you have:
authorize { ... body = "json" }
and your method isn't GET or DELETE.
I've added more documentation to the rest default config file if you want to update your local copy.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 26 Mar 2014, at 19:32, Werner Stucky <wernerml@stucky-solutions.net> wrote:
body = "post" seems to be working fine
I'm getting the multiple Framed-Route attributes too :)
Well that's good :)
Not sure about the body = "json"
And that's really weird.. Thu Mar 27 10:13:10 2014 : Debug: (1) # Executing section authorize from file /usr/local/freeradius-3.0.x/etc/raddb/sites-enabled/default Thu Mar 27 10:13:10 2014 : Debug: (1) authorize { Thu Mar 27 10:13:10 2014 : Debug: (1) modsingle[authorize]: calling rest (rlm_rest) for request 1 Thu Mar 27 10:13:10 2014 : Debug: rlm_rest (rest): Reserved connection (4) Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Expanding URI components Thu Mar 27 10:13:10 2014 : Debug: http://127.0.0.1:9090 Thu Mar 27 10:13:10 2014 : Debug: Parsed xlat tree: Thu Mar 27 10:13:10 2014 : Debug: literal --> http://127.0.0.1:9090 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : EXPAND http://127.0.0.1:9090 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : --> http://127.0.0.1:9090 Thu Mar 27 10:13:10 2014 : Debug: / Thu Mar 27 10:13:10 2014 : Debug: Parsed xlat tree: Thu Mar 27 10:13:10 2014 : Debug: literal --> / Thu Mar 27 10:13:10 2014 : Debug: (1) rest : EXPAND / Thu Mar 27 10:13:10 2014 : Debug: (1) rest : --> / Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Sending HTTP POST to "http://127.0.0.1:9090/" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Request body content-type will be "application/json" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Encoding attribute "User-Name" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Type : string Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Length : 3 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Value : "foo" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Encoding attribute "User-Password" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Type : string Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Length : 3 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Value : "bar" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Encoding attribute "NAS-IP-Address" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Type : ipaddr Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Length : 13 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Value : "192.168.146.1" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Encoding attribute "NAS-Port" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Type : integer Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Length : 1 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Value : 0 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Encoding attribute "Message-Authenticator" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Type : octets Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Length : 34 Thu Mar 27 10:13:10 2014 : Debug: (1) rest : Value : "0x33bf98942c5ea4eee2466c87dc6558c5" Thu Mar 27 10:13:10 2014 : Debug: (1) rest : JSON Data: {"User-Name":{"type":"string","value":["foo"]},"User-Password":{"type":"string","value":["bar"]},"NAS-IP-Address":{"type":"ipaddr","value":["192.168.146.1"]},"NAS-Port":{"type":"integer","value":[0]},"Message-Authenticator":{"type":"octets","value":["0x33bf98942c5ea4eee2466c87dc6558c5"]}} It works fine for me... Could you try the latest v3.0.x HEAD, there's some more code in there to catch invalid (or unsupported) body types, it which might show what's going on. My config looks like: authorize { timeout = 2 uri = "http://127.0.0.1:9090/" method = "post" body = "json" tls = ${..tls} } -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (2)
-
Arran Cudbard-Bell -
Werner Stucky