Post-proxy attribute filtering oddness

[stefan.paetow at diamond.ac.uk]

Hi, 

I've got some post-proxy attribute filtering oddness. The servers are both FreeRADIUS 3.0.1. I send an EAP-TTLS/EAP-GTC (or EAP-TTLS/PAP) authentication to my home server (172.23.142.184), which then proxies the request to the UMBRELLAID.ORG realm's server (172.23.142.185). On return, I can see both MS-MPPE-Send-Key and MS-MPPE-Recv-Key in the response, but if I have attr_filter.post-proxy switched on, the MS-MPPE-Send-Key disappears by the beginning of post-auth (so I'm venturing to guess that this triggers a match in the post-proxy attribute filter). When attr_filter.post-proxy is commented out, it is there.

The attr_filter/post-proxy file is standard to the distribution with exception of the addition of the following three lines:

DEFAULT:
	User-Name =* ANY,
	Class =* ANY,
	Chargeable-User-Identity =* ANY,
	:
	:

(for clarity, the colons are indicative of the remainder of the DEFAULT entry)

I have two logs, one with an Access-Accept with no MS-MPPE-Send-Key (i.e. with filter enabled), one with an Access-Accept with MS-MPPE-Send-Key (filter disabled). The two logs are at https://www.dropbox.com/sh/0j6num17n2tt0mm/sX8GwxgZjR

I'm flummoxed! Can someone explain this? Alan D? Alan B? Arran? Anyone?

With Regards

Stefan


-- 
This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail.
Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. 
Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message.
Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom