Authorization in RADIUS, Authorization in freeradius

[Doug Hardie]

On Sep 2, 2007, at 08:52, George Beitis wrote:

>  Do
> you know of any products that can be used with freeradius to provide
> such authorization facilities?  Using perhaps policies?

I have a number of authorization policies implemented using  
FreeRadius.  I have a module that implements those policy decisions  
based on the attributes that are sent with the request.  I believe  
the authorization decision is made after the authentication check,  
but not sure about that.  A check of the debug output would show that  
clearly.  However, either way would work for me.  Both authentication  
and authorization have to pass or the request is denied.  Generally I  
get more authorization failures than authentication failures.   
However, when a user's dialer corrupts the password, there will be a  
long string of authentication failures as they just keep trying the  
same thing over and over again.  Most of them don't bother to read  
the returned message.  After a week or so they will contact us.