Normalising the User-Name AVP in an Access-Accept

[Alan DeKok]

Nick Lowe wrote:
> I am curious if it is possible today with FreeRADIUS to normalise the
> identity that is returned in the User-Name AVP in an Access-Accept?

  Yes.  You can do pretty much anything you want.

> RFC 2865 states in Section 5.1:
> 
> [The User-Name AVP] MAY be sent in an Access-Accept packet, in which
> case the client SHOULD use the name returned in the Access-Accept
> packet in all Accounting-Request packets for this session.

  Well... not all NASes do that, of course.

> So, a compliant NAS that is able to treat the User-Name AVP as being
> authoritative would get to see the real, inner identity and in a
> normalised form.
> 
> Is this possible?

  Yes.  I suggest writing down all possible *input* variants of the
User-Name.  Then, determine what you want as output.  And figure out how
to get from one to the other.  i.e. "foo" -> "foo at example.com",
"foo\EXAMPLE" --> "foo at example.com".

  Once you have all of those mappings, just write "unlang" policies to
check one after the other, and do the re-writing.

  Most of the time, you can write policies down in plain English, and
convert them to unlang.

  Alan DeKok.