Pass client attributes from client.conf to post-auth section
Alexey D. Filimonov
alexey at filimonic.net
Wed Oct 30 20:19:33 UTC 2024
Is it possible to have client shortname (from clients.conf) or any
custom per-client property inside post-auth and post-proxy block?
Problem: I have multiple physical locations of different "types", each
location type has it's own requirement for Tunnel-Private-Group-Id.
With MS NPS, I have AAA clients named
location-a at location-type-x@ap1
location-a at location-type-x@ap2
location-b at location-type-x@ap1
location-c at location-type-z@ap1
location-c at location-type-z@ap2
And I build access rules logic with conditions like "rule when client
name match /@location-type-x@/" and "another rule when client name match
/@location-type-z@/".
With FreeRADIUS I found no information about client shortname in
debug_all output inside post-auth block.
I can build huge ruleset of additional unlang logic like this, or maybe
more simple...
if (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid1/) {
update response { Tunnel-Private-Group-Id = "100" }
} elsif (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid2/) {
update response { Tunnel-Private-Group-Id = "101" }
} elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid1/) {
update response { Tunnel-Private-Group-Id = "100" }
} elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid2/) {
update response { Tunnel-Private-Group-Id = "101" }
} elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid1/) {
update response { Tunnel-Private-Group-Id = "203" }
} elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid2/) {
update response { Tunnel-Private-Group-Id = "204" }
} ...
But in my opinion, 1) there must be a way not to duplicate client
address information in both post-auth and clients.conf 2) amount of code
looks stupid when scaled to tens of locations.
More information about the Freeradius-Users
mailing list