Performing an additional check on the credentials

[Alan DeKok]

Romeo Mihalcea wrote:
> I successfully managed to deploy a freeradius server and created a
> python script which does an additional check on the user (incoming
> request). I checked the internet (resources for freeradius are pretty
> horrible)

  Well... the server comes with a lot of documentation.  Searching
random pages on the internet isn't a good idea.

> and only found a thread which explains some basics about
> adding a python script to the process.

  That isn't well documented because no one has contributed documentation.

> Right now I have it inside /etc/freeradius/sites-enabled/default under
> the authorize section:
> 
> update control {
>        Auth-Type := `/usr/bin/python /etc/test.py '%{User-Name}'
> '%{User-Password}'`
> }

  While that works, I wouldn't recommend doing it.  It's just using
python as an external script.  i.e. there's no python-specific
documentation needed.  You could use `/bin/echo Accept` to get much the
same affect.

> My test.py file spits Reject or Accept. I also have sql authentication

  No... the SQL module does authorization checks.  They really are
different, and the difference is important.  See the wiki for more
discussion on this topic.

> setup with freeradius and the problem is that, if my script returns
> Accept any other authorization request under is ignored; response will
> still be an Accept even if sql check rejects the user.

  Yes, that's what you told it to do.  Which is why the FAQ says to
*not* set Auth-Type.  It's almost always wrong.

> From what I understand I should pass a noop instead of Accept to allow
> freeradius to continue and only pass Reject if I need to reject the user
> but If I respond with noop the server complains (probably because it
> expects a reply for Auth-Type as I coded it).

  No.  "noop" isn't an authentication type.  You're mixing multiple
topics without a clear understanding of any of them.

> Someone on serverfault suggested I shouldnt use unlang to call a python
> script and I should use rlm_python but I really have no idea how to even
> start calling my script.
> 
> Any ideas? Maybe I need to add my code to the Authentication. section? How?

  What you want to do?  Please explain what you have, and what you want.

  Right now you're describing a "solution" that doesn't work.  You're
not describing a problem.  There's really no point in trying to fix the
solution until the problem is clear.  If we do, we'll be stuck on
miscommunication and misunderstanding.

  Alan DeKok.