using different LDAP queries to authorize for different services

[Alan DeKok]

Sylvain Robitaille wrote:
> I apologize if I'm seeming dense, or leaving the impression that I
> haven't read documentation that you've already pointed me at.  I *have*
> read that documentation, but I think the problem is that I'm struggling
> to wrap my head around the details, perhaps because it seems that not
> only are there many options, but there seem to be indeed several ways
> that the same result *might* be achieved.

  There is functionality in the server that's historical.  The new
"unlang" is generally preferred for anything resembling a complex
configuration.

> Ok, I think I see it now.  The debug output from the inner-tunnel starts
> here then?

  Yes.  EAP-TTLS does PAP inside of a Diameter AVP inside of a TLS
tunnel, which is encapsulated in the TTLS EAP method, which is
encapsulated inside of a RADIUS EAP-Message attribute, which goes into a
RADIUS packet, over UDP, IP, and Ethernet.

  See?  Nothing could be simpler.  <umm..>

> Well, I'm trying these options and configurations because I do really
> want to accomplish the result I'm after.  That I've been doing it all
> wrong is simply an indication that I *still* haven't understood the way
> the server functions.  I promise that it isn't because I'm not trying. :-(

  EAP-TTLS sets up a TLS tunnel between the server and the end machine
(XP, Linux, etc.).  It then does a normal authentication request inside
of the tunnel.  But since the NAS can't see inside of the tunnel, there
are no NAS attributes inside of the tunnel.

> Hrmmm...  I just spotted why I didn't understand that previously from
> "man unlang", but rather needed you to explain it to me directly:
..
> It talks about being able to *update* items in the outer request

  In the documentation about the "update" section.

  The later documentation about attribute references says you can make
references to lists...

> I'd offer to patch the documentation to make it clear that the
> inner-tunnel can reference *attributes* from the outer request using
> "outer.Attribute-Name", but it seems despite all I've learned from all
> of these experiments and from the help I've gotten on the mailing list, I
> have only scratched the surface of what there is to know about FreeRadius,
> and I would likely write yet more partially-correct-at-best third-party
> documentation that folks really shouldn't follow.  :-(

  I'm trying to write a book, honest.  I think I should probably just
give up, and put the 200 pages I have up on the net for review.

> Once again, thanks for ALL the help.  I think I now have everything I
> need to do exactly what I want.

  See?  It's easy... just run into a couple of bugs, bang your head
against the wall, and you've got it made...

  Alan DeKok.