Enable Perl module in combination with EAP/SIM module

[Arran Cudbard-Bell]

On 3 Jan 2014, at 18:32, Shurbann Martes <shurbann at gmail.com> wrote:

> You're right when you're so deep into a problem you assume that the issue at hand is clear to everyone without sounding to cryptic. Let me try to explain the problem at hand little bit more. I'm trying not to bother you much with the details, but still be as clear as possible.
> 
> What' we're trying to accomplish here is to map (this was the typo ammped in the earlier message) every RADIUS call to an HTTP call on another system. We did not find any correct solution for this other that using the Perl module.

Um...

> That's the reason we start using Perl module. So for example a Access-Request will call a URL using HTTP GET on the other system, with HTTP parameters containing the necessary info, i.e. user, Called-Station-Id etc. Based on the response i.e. HTTP status response 403, 401 or 202 received from this system, we will send a Access-Accept or Access-Reject back to the NAS. This is working OK, right now using the Auth-Type = Perl.

The REST module does exactly this (rlm_rest). It's included in 3.0.0. It will be *SIGNIFICANTLY* faster than  Perl, and is written in such a way to allow libcurl to do connection caching so you don't have the TCP connection setup/teardown after every request. 

> However with the introduction of the EAP-SIM module as part of the protocol we're going to use, I was wondering if I can have FreeRADIUS configured better, by trying not to use the Auth-Type. So I'm trying to find out what the correct way of doing this is.

IIRC (but you'll need to test), that if you call rlm_eap in post-auth reject {} it'll generate the correct eap failure message. Which means if the user is rejected by the HTTP server, FreeRADIUS will send an EAP-Failure with the Access-Reject.

Call rest/perl in authorize.

Call eap in authorize (it will set Auth-Type eap)

Leave auth-type eap in authenticate.

Call eap in post-auth reject {}.

Simple.

Arran Cudbard-Bell <a.cudbardb at freeradius.org>
FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 881 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140103/136d81ea/attachment.pgp>