cache entry time

[Eric Lin]

Hi

The freeradius is used as radius proxy to proxy radius auth request to
backend NPS server for MFA.

The scenario we would like to achieve is the following:
1. client sends username/OTP to freeradius-proxy that relays to NPS
server. NPS server accepts and replies to freeradius-proxy that relays
to the client.

2. client sends same username/OTP within TTL to freeradius-proxy that
accepts and replies to client.

with the following config, I can make the scenario work, but I notice
the cache entry TTL is timed when radius client sends radius auth
request, not the time when user finishes OTP response. For example,
user logins at 9:05:12AM and finish OTP/MFA at 9:05:34AM. The cache
TTL is timed at 9:05:12AM. Which config should be adjusted to make the
cache time correct?

Regards,
Eric

### customization
cache otpcache {
        # note - we need to escape the key values
        # otherwise the client can perform injection/overlap
        # attacks by modifying their username
        driver = "rlm_cache_rbtree"
        key = "%{sha256:%{User-Name}}/%{sha256:%{User-Password}}/%{sha256:%{MS-Machine-Name}}/%{sha256:%{Calling-Station-Id}}"
        ttl = 120
        update {
                # <list>:<attribute> <op> <value>

                # Cache all instances of Reply-Message in the reply list
                &reply:Reply-Message += &reply:Reply-Message[*]

                # Add our own to show when the cache was last updated
                &reply:Reply-Message += "Cache last updated at %t"
        }
}
### end of customization


authorize {
        ### customization
        # first, just check the cache, don't
        # create entries or set reply attrs
        update control {
                Cache-Status-Only = yes
        }
        otpcache

        if (ok) {
        # entry found in cache; set auth type to accept
        # and call cache again to get reply attrs
                update control {
                        Cache-Status-Only !* ANY
                }
                accept
                otpcache
                ok
        }
        else {
        # future cache lookups here, and in post-auth,
        # should be normal ones
                update control {
                        Cache-Status-Only !* ANY
                }
        }
        ### end of customization
}


post-auth {
        ### customization
        if (control:Auth-Type == Accept) {
                # first, delete any existing cache entries
                update control {
                        Cache-TTL = 0
                }

                # clear that variable
                update control {
                        Cache-TTL !* ANY
                }

                # now cache the reply
                otpcache
        }
        ### end of customization
}