Enable Perl module in combination with EAP/SIM module

[Shurbann Martes]

Thank you for pointing out the rest module. At this moment we are on the
2.2.x version, but we will consider to move to version 3.0.0.

Regards,
Shurbann Martes



On Fri, Jan 3, 2014 at 3:13 PM, Arran Cudbard-Bell <
a.cudbardb at freeradius.org> wrote:

>
> On 3 Jan 2014, at 18:32, Shurbann Martes <shurbann at gmail.com> wrote:
>
> > You're right when you're so deep into a problem you assume that the
> issue at hand is clear to everyone without sounding to cryptic. Let me try
> to explain the problem at hand little bit more. I'm trying not to bother
> you much with the details, but still be as clear as possible.
> >
> > What' we're trying to accomplish here is to map (this was the typo
> ammped in the earlier message) every RADIUS call to an HTTP call on another
> system. We did not find any correct solution for this other that using the
> Perl module.
>
> Um...
>
> > That's the reason we start using Perl module. So for example a
> Access-Request will call a URL using HTTP GET on the other system, with
> HTTP parameters containing the necessary info, i.e. user, Called-Station-Id
> etc. Based on the response i.e. HTTP status response 403, 401 or 202
> received from this system, we will send a Access-Accept or Access-Reject
> back to the NAS. This is working OK, right now using the Auth-Type = Perl.
>
> The REST module does exactly this (rlm_rest). It's included in 3.0.0. It
> will be *SIGNIFICANTLY* faster than  Perl, and is written in such a way to
> allow libcurl to do connection caching so you don't have the TCP connection
> setup/teardown after every request.
>
> > However with the introduction of the EAP-SIM module as part of the
> protocol we're going to use, I was wondering if I can have FreeRADIUS
> configured better, by trying not to use the Auth-Type. So I'm trying to
> find out what the correct way of doing this is.
>
> IIRC (but you'll need to test), that if you call rlm_eap in post-auth
> reject {} it'll generate the correct eap failure message. Which means if
> the user is rejected by the HTTP server, FreeRADIUS will send an
> EAP-Failure with the Access-Reject.
>
> Call rest/perl in authorize.
>
> Call eap in authorize (it will set Auth-Type eap)
>
> Leave auth-type eap in authenticate.
>
> Call eap in post-auth reject {}.
>
> Simple.
>
> Arran Cudbard-Bell <a.cudbardb at freeradius.org>
> FreeRADIUS Development Team
>
> FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140103/fe827b0d/attachment.html>