PEAP request with EAP-MSCHAPv2 as Phase 2, how to store attribute data.

work vlpl thework.vlpl at gmail.com
Thu Nov 9 19:41:24 CET 2017


Hello,

I use configuration what can handle PEAP +  EAP-MSCHAPv2 as Phase 2
and proxy inner tunnel request to another home server.
I need log request with real username (inner identity) and other
custom attribute available in inner tunnel phase. For other requests
like EAP-TTLS/PAP it is trivial, in authorize section I save
attributes of interest to me in control list, because proxy response
override reply list. Proxy response set back to inner tunnel and In
post-auth section I expand stored attributes and linelog directive do
work.

Then request type is PEAP +  EAP-MSCHAPv2 as Phase 2, proxy save
response to "some temporary storage" (Saving tunneled attributes for
later)

(101) eap: Doing post-proxy callback
(101) eap: Passing reply from proxy back into the tunnel
(101) eap: Got tunneled reply RADIUS code 2
(101) eap:   EAP-Message = 0x03080004
(101) eap:   Message-Authenticator = 0x21a9b5e96fc954c7cb0713477905fe5b
(101) eap:   User-Name = "testing_remote"
(101) eap:   Proxy-State = 0x38
(101) eap: Tunneled authentication was successful
(101) eap: SUCCESS
(101) eap: Saving tunneled attributes for later
(101) eap: Reply was handled

And after that supplicant sent final request. Freeradius clear the
control list (checked it with debug_all directive, I am not asking
freeradius to do it, it happens automaticly), so I lost my attributes
saved in control list.
Freeradius continue eap session and restore User-Name to reply list
from temporary storage,

(102) eap_peap: [eaptls process] = ok
(102) eap_peap: Session established.  Decoding tunneled attributes
(102) eap_peap: PEAP state send tlv success
(102) eap_peap: Received EAP-TLV response
(102) eap_peap: Success
(102) eap_peap: Using saved attributes from the original Access-Accept
(102) eap_peap:   User-Name = "testing_remote"
(102) eap_peap:     caching User-Name = "testing_remote"
(102) eap_peap: Failed to find 'persist_dir' in TLS configuration.
Session will not be cached on disk.
(102) eap: Sending EAP Success (code 3) ID 9 length 4
(102) eap: Freeing handler
tls: Freeing cached session VPs

So in post-auth section I have real username, but los my custom
attributes stored in control list.

(102) EXPAND %{reply:User-Name}
(102)              --> testing_remote
(102)           EXPAND %{control:User-Name}
(102)              -->
(102)           EXPAND %{User-Name}
(102)              --> anonymous

If is it possible, how I can store my custom attributes to "some
temporary storage" to have access to them in the very last stage.


More information about the Freeradius-Users mailing list