3GPP: multiple attributes, port from file based authentication to sql
Hi there, I'm currently running freeradius to authenticate mobile devices on a 4G network. For authentication I have to check multiple attributes. The user - file is currently populated like that: user Cleartext-password := "password", 3GPP-IMSI == 262011234567, Called-Station-ID == "apn-name" User-Name = user, Service-Type = Framed, Framed-Protocol = GPRS-PDP-Context, Framed-IPv6-Prefix = 2001:DB8::/64, Framed-Interface-ID = 0:0:0:2, Reply-Message = "Welcome To Lab Network", Acct-Session-Id = 00000001, I'm currently wondering, how to port that into the radcheck and the radreply table. I understood, whith the default configuration, only one attribute will be checked, e.g. Cleartext-password Thank you for support Wolfgang
On Mar 24, 2018, at 9:02 AM, Wolfgang Zeitler <zeitler.wolfgang@gmx.de> wrote:
I'm currently running freeradius to authenticate mobile devices on a 4G network. For authentication I have to check multiple attributes. The user - file is currently populated like that:
user Cleartext-password := "password", 3GPP-IMSI == 262011234567, Called-Station-ID == "apn-name" User-Name = user, Service-Type = Framed, Framed-Protocol = GPRS-PDP-Context, Framed-IPv6-Prefix = 2001:DB8::/64, Framed-Interface-ID = 0:0:0:2, Reply-Message = "Welcome To Lab Network", Acct-Session-Id = 00000001,
Acct-Session-Id shouldn't go back in the response. Or, it can go there, but nothing will look at it.
I'm currently wondering, how to port that into the radcheck and the radreply table.
As is?
I understood, whith the default configuration, only one attribute will be checked, e.g. Cleartext-password
So. See the wiki. Look for "sql", and read the rlm_sql documentation. You can copy that "users" file entry pretty much verbatim... Alan DeKok.
Dear Alan, Thank you for your prompt reply. As it is in the wiki: mysql> select * from radcheck; +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ | 1 | fredf | Cleartext-Password | wilma | := | | 2 | barney | Cleartext-Password | betty | := | | 2 | dialrouter | Cleartext-Password | dialup | := | +----+----------------+--------------------+------------------+------+ 3 rows in set (0.01 sec) This is understood, but my attributes have to be validated with AND. For my understanding, I would need something like that: +----+----------------+--------------------+------------------+------+--------------------+------------------+------+ | id | UserName | Attribute1 | Value1 | Op1 | Attribute2 | Value2 | Op2 | +----+----------------+--------------------+------------------+------+--------------------+------------------+------+ | 1 | user | Cleartext-Password | password | := | 3GPP-IMSI | 262011234567 | == | Am I wrong? Wolfgang
On Mar 24, 2018, at 9:14 AM, Wolfgang Zeitler <zeitler.wolfgang@gmx.de> wrote:
This is understood, but my attributes have to be validated with AND. For my understanding, I would need something like that:
No.
+----+----------------+--------------------+------------------+------+--------------------+------------------+------+ | id | UserName | Attribute1 | Value1 | Op1 | Attribute2 | Value2 | Op2 | +----+----------------+--------------------+------------------+------+--------------------+------------------+------+ | 1 | user | Cleartext-Password | password | := | 3GPP-IMSI | 262011234567 | == |
Am I wrong?
Yes. You just list the attributes, as in the "users" file. The only real change is that you have to put a "userName" field in every row. As I said, you can just copy the "users" file entry to SQL, pretty much as-is. How about trying that instead of arguing? Alan DeKok.
participants (2)
-
Alan DeKok -
Wolfgang Zeitler