#eduroam Config
#2016-09-09 eduroam-wireless test groep toegevoegd (lumc accounts in vlan420)

#tracelevel 0
Foreground
LogStdout

AuthPort    1645,1812
AcctPort    1646,1813

DbDir       C:\Program Files\Radiator
LogDir      D:\Radiator\Log
LogFile     %L\Radiator_%Y-%m-%d.txt
Trace       0

# The name of the file where the radius PID will be written
# after startup, so we don't conflict with another radiusd
PidFile C:\Program Files\Radiator\radiusd.pid


#--------------------------------------------------

#logt de succes en failure authentications int LUMCer
<AuthLog FILE>
         Identifier logfile_LUMC_int
         Filename   %L/authlog_LUMC_int_%Y-%m-%d.txt
         LogSuccess 1
         SuccessFormat '%H:%M:%S', OK, '%N, %U, %u'
         LogFailure 1
         FailureFormat '%H:%M:%S', %1, '%N, %U, %u'
 </AuthLog>

#logt de succes en failure authentications ext LUMCer
<AuthLog FILE>
         Identifier logfile_LUMC_ext
         Filename   %L/authlog_LUMC_ext_%Y-%m-%d.txt
         LogSuccess 1
         SuccessFormat '%H:%M:%S', OK, '%N, %U, %u'
         LogFailure 1
         FailureFormat '%H:%M:%S', %1, '%N, %U, %u'
 </AuthLog>

#logt de succes en failure authentications niet LUMCer
<AuthLog FILE>
         Identifier logfile_niet_LUMC
         Filename   %L/authlog_not_LUMC_%Y-%m-%d.txt
         LogSuccess 1
         SuccessFormat '%H:%M:%S', OK, '%N, %U, %u'
         LogFailure 1
         FailureFormat '%H:%M:%S', %1, '%N, %U, %u'
 </AuthLog>

#logt de unknown authentications
<AuthLog FILE>
         Identifier logfile_unknown
         Filename   %L/authlog_unknown_%Y-%m-%d.txt
         LogSuccess 1
         SuccessFormat '%H:%M:%S', OK, '%N, %U, %u'
         LogFailure 1
         FailureFormat '%H:%M:%S', %1, '%N, %U, %u'
 </AuthLog>


#--------------------------------------------------

#Accounting

#Accounting status type = Alive
<Handler Request-Type = Accounting-Request,Acct-Status-Type = Alive>
        Identifier Accounting_log1
        #Log accounting to a detail accounting file
        AcctLogFileName %L/acct_log_%Y-%m-%d.txt
        AcctLogFileFormat %H:%M:%S,Alive,%{User-Name},%{Acct-Session-Id},%{Calling-Station-Id},\
            %{Framed-IP-Address}
        AccountingHandled
</Handler>

#Accounting status type = stop
<Handler Request-Type = Accounting-Request,Acct-Status-Type = Stop>
        Identifier Accounting_log2
        #Log accounting to a detail accounting file
        AcctLogFileName %L/acct_log_%Y-%m-%d.txt
        AcctLogFileFormat %H:%M:%S,Stop,%{User-Name},%{Acct-Session-Id},%{Calling-Station-Id}
        AccountingHandled
</Handler>

#Accounting status type = start
<Handler Request-Type = Accounting-Request>
        Identifier Accounting_log3
        #Log accounting to a detail accounting file
        #AcctLogFileName %L/acct_logov_%Y-%m-%d.txt
        AccountingHandled
</Handler>

#--------------------------------------------------

#Inner authentication voor externe LUMCers via surfnet
<Handler Client-Identifier=SURFnet, TunnelledByPEAP=1>
       Identifier PEAPTunnel_intern_LUMCext
       <AuthBy GROUP>
         AuthByPolicy ContinueWhileReject
          <AuthBy LSA>
          # eduroam-test
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group eduroam-wireless
          </AuthBy>
            <AuthBy LSA>
            # divisie 1
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-1
            </AuthBy>
            <AuthBy LSA>
            # divisie 2
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-2
            </AuthBy>
              <AuthBy LSA>
            # divisie 3
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-3
            </AuthBy>
            <AuthBy LSA>
            # divisie 4
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-4
            </AuthBy>
            <AuthBy LSA>
            # divisie 5
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-5
            </AuthBy>
            <AuthBy LSA>
            # Curium
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-8
            </AuthBy>
            <AuthBy LSA>
            # divisie 0
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-0
            </AuthBy>
        </AuthBy>
       AuthLog logfile_LUMC_ext
</Handler>


#Inner authentication voor externe LUMCers via surfnet
#<Handler Client-Identifier=From_RADIUSProxy>
<Handler Client-Identifier=From_RADIUSProxy, TunnelledByPEAP=1>
       Identifier PEAPTunnel_intern_LUMCext
       <AuthBy GROUP>
         AuthByPolicy ContinueWhileReject
          <AuthBy LSA>
          # eduroam-test
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group eduroam-wireless
          </AuthBy>
            <AuthBy LSA>
            # divisie 1
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-1
            </AuthBy>
            <AuthBy LSA>
            # divisie 2
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-2
            </AuthBy>
              <AuthBy LSA>
            # divisie 3
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-3
            </AuthBy>
            <AuthBy LSA>
            # divisie 4
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-4
            </AuthBy>
            <AuthBy LSA>
            # divisie 5
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-5
            </AuthBy>
            <AuthBy LSA>
            # Curium
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-8
            </AuthBy>
            <AuthBy LSA>
            # divisie 0
                 EAPType MSCHAP-V2
                 DefaultDomain lumcnet
                 UsernameMatchesWithoutRealm
                 Group lumc-wireless-0
            </AuthBy>
        </AuthBy>
       AuthLog logfile_LUMC_ext
</Handler>


#----------------------------------------------------------
#----------User Authentication-----------------------------
#----------------------------------------------------------

#Inner authentication voor interne LUMCers direct vanuit qmanage zonder PEAP tunnel
<Handler Client-Identifier=qmanage,MS-CHAP2-Response=/.+/>
Identifier LUMCusers
    <AuthBy HANDLER>
    HandlerId LUMCusers_AD
    </AuthBy>
        AuthLog logfile_LUMC_int
</Handler>

#----------------------------------------------------------

#Inner authentication voor interne LUMCers direct vanuit de wireless controlers met PEAP tunnel
<Handler TunnelledByPEAP=1>
Identifier LUMCusers
    <AuthBy HANDLER>
    HandlerId LUMCusers_AD
    </AuthBy>
        AuthLog logfile_LUMC_int
</Handler>
#---------------------------------------------------------

#Inner authentication voor interne LUMCers met windows AD
<Handler Identifier=LUMCusers>
     Identifier LUMCusers_AD
    <AuthBy GROUP>
      AuthByPolicy ContinueWhileReject
          <AuthBy LSA>
          # eduroam override
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group eduroam-wireless
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:420
          </AuthBy>
          <AuthBy LSA>
          # divisie 1
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-1
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:281
          </AuthBy>
          <AuthBy LSA>
          # divisie 2
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-2
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:282
          </AuthBy>
          <AuthBy LSA>
          # divisie 3
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-3
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:283
          </AuthBy>
          <AuthBy LSA>
          # divisie 4
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-4
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:284
          </AuthBy>
          <AuthBy LSA>
          # divisie 5
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-5
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:285
          </AuthBy>
          <AuthBy LSA>
          # Curium
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-8
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:288
          </AuthBy>
          <AuthBy LSA>
          # divisie 0
             EAPType MSCHAP-V2
             DefaultDomain lumcnet
             UsernameMatchesWithoutRealm
             Group lumc-wireless-0
             AddToReply Tunnel-Type=1:VLAN,Tunnel-Medium-Type=1:Ether_802,Tunnel-Private-Group-ID=1:280
          </AuthBy>
    </AuthBy>
</Handler>

#--------------------------------------------------

#outer authentication
<Handler Realm=/^lumc\.nl$/i, EAP-Message=/.+/>
     <AuthBy FILE>
         Identifier OuterAuth
         EAPType PEAP
         EAPAnonymous %0
         EAPTLS_CAFile %D/radius_lumc_nl.pem
         EAPTLS_CertificateFile %D/radius_lumc_nl.pem
         EAPTLS_CertificateType PEM
         EAPTLS_PrivateKeyFile %D/radius_lumc_nl.pem
         EAPTLS_SessionResumption 1
         EAPTLS_MaxFragmentSize 1024
         AutoMPPEKeys
         EAPTLS_PEAPVersion 0
     </AuthBy>
</Handler>


<Handler>
        <AuthBy INTERNAL>
           DefaultResult reject
        </AuthBy>
        AuthLog logfile_unknown
</Handler>