Enable Perl module in combination with EAP/SIM module

[Alan DeKok]

Shurbann Martes wrote:
> What' we're trying to accomplish here is to map (this was the typo
> ammped in the earlier message) every RADIUS call to an HTTP call on
> another system. We did not find any correct solution for this other that
> using the Perl module.

  If you use v3, the rest module should work.  See Arran's post.

> That's the reason we start using Perl module. So
> for example a Access-Request will call a URL using HTTP GET on the other
> system, with HTTP parameters containing the necessary info, i.e. user,
> Called-Station-Id etc. Based on the response i.e. HTTP status response
> 403, 401 or 202 received from this system, we will send a Access-Accept
> or Access-Reject back to the NAS. This is working OK, right now using
> the Auth-Type = Perl.

  This is not the recommended approach.  FreeRADIUS is an authentication
server.  You should have it do authentication.  Other systems used by
FreeRADIUS are databases.  Any other design is almost always wrong.

  You can use the Perl module in the "authorize" section.  Have it
create an attribute 'allowed = yes / no".  See raddb/dictionary for
examples of creating a new attribute to hold this value.

  Then, use FreeRADIUS to decide whether or not the user is authenticated.

> However with the introduction of the EAP-SIM module as part of the
> protocol we're going to use, I was wondering if I can have FreeRADIUS
> configured better, by trying not to use the Auth-Type. So I'm trying to
> find out what the correct way of doing this is.

  Make authorization decisions as above.  What you're describing above
is whether or not the user is *authorized* to use the service.  Since
you didn't check passwords, you have no idea whether or not he's been
*authenticated*.

  Many authentication protocols require complex back and forth work.
Don't re-do all of that in Perl.  Instead, let FreeRADIUS do
authentication.  Your script should do authorization.

  Alan DeKok.