Compiling modules

[Matthew Newton]

On Mon, 2017-11-27 at 10:01 +0000, Jonathan Anthony wrote:
> I am still a little confused.  What we are doing is that we have a
> secure box for storing, initially usernames and passwords using our
> own built hardware/software.
> 1.  We want to write a "plug-in" which I assume will be a module, so
> that when authenticating a user, it will send a command to our box.
> The box returns simply yes or no depending if the password matches. I
> thought rlm_pap authenticates using the flat users file. So we
> assumed that if we modified pap, this would work. Sorry if this is
> stupid question but I have just started with Radius

No, the rlm_files reads the flat users file. It can, as an example, set
the Cleartext-Password attribute with the known password of the user.

rlm_pap checks that the User-Password supplied in the RADIUS request
matches with the password in the Cleartext-Password, Password-with-
Header or other similar attributes.

So combined they will do what you are thinking.

The usual method is to supply the password from the database (I guess
in this case your own solution) to the RADIUS server, and then the
RADIUS server checks that the password is correct.

The password can be supplied by many means - hence rlm_files (users
file), rlm_ldap (read from LDAP), rlm_sql (read from an SQL database),
etc.

> 2. Say our authentication is called SNAP. How does the radius server
> select our module to authenticate. I did notice a "hints" file but
> not sure how this will work.

As an example, in the authorize{} section the files module will read
the Cleartext-Password for the user, and the pap module will detect
that there is a Cleartext-Password and a User-Password (supplied in the
request) and set the Auth-Type to "PAP".

Then the server calls the authenticate{} section called "PAP", which
again calls the pap module to check that the username and password are
correct.

You can mix and match these as you like, or set Auth-Type yourself
(though this is not recommended, most people get it wrong).

I guess the main question is why you need to write a C module to talk
to your solution. What protocols do you support. For instance, if you
have an HTTP REST API, then you can already use rlm_rest to talk to it.

Read the "concepts" and "getting started" pages on the wiki for another
explanation of how the server works.

-- 
Matthew