Authentication with Vendor-Specific Attribute

[Alan DeKok]

On Apr 20, 2021, at 5:57 AM, Daniel Kastner <daniel.kastner at karakun.com> wrote:
> 
> I'm totally new to this (free)Radius stuff and trying to achieve authentication based on a vendor-specific attribute send by the client.
> 
> I've add the custom attribute in a new dictionary file /opt/share/freeradius/dictionary.myvendor:
> 
> VENDOR MyVendor 16132
> BEGIN-VENDOR  MyVendor
> ATTRIBUTE MyVendor -OneTimePassword 1 string
> END-VENDOR MyVendor

  That seems fine.  It's better to use the actual vendor name, though,

> Included it in the /opt/share/freeradius/dictionary:
> 
> $INCLUDE dictionary.myvendor

  That will get over-written on the next install of the server.  The installation process assumes that you don't edit the default dictionaries.

  You can put the $INCLUDE into raddb/dictionary, where it will not get over-written.  The installation process assumes that you edit the files in raddb/, so it doesn't over-write them.

> And now trying the following in file /opt/etc/raddb/mods-config/files/authorize:
> 
> bob Cleartext-Password := "hello"
>  if( &MyVendor-OneTimePassword == "123456" ) {
>    Auth-Type := Accept
>    Reply-Message := "Hello %{User-Name}, great to have you here!"
>  } else {
>    Auth-Type := Reject
>    Reply-Message := "Sorry %{User-Name}, wrong OTP"
> }

  That's not the format of the "authorize" file.  See the many other examples in that file, and "man users" documentation for it.

  You can put the "bob" line into the "authorize" file.

  The rest has to go into raddb/sites-available/default, in the "authorize" section.  There are many examples of if / then / else logic in that file.

  Alan DeKok.