[RADIATOR] multiple hosts

Alexander Hartmaier alexander.hartmaier at t-systems.at
Fri Nov 25 03:02:31 CST 2011


I have one radiator that needs to ask two other radius servers one after 
another.
In the Handler i've configured the first radius server with an AuthBy 
RADIUS which includes a ReplyHook.

This is the hook script:

use strict;
use warnings;
use Data::Dumper;

# this hook copies the @proxied_attrs from the answer of the radius server
# to the request to the next radius server and dispatches another request
sub {
     my $p  = ${$_[0]};  # reply packet from remote radius server
     my $rp = ${$_[1]};  # reply packet to NAS
     my $op = ${$_[2]};  # original request packet
     my $sp = ${$_[3]};  # packet sent to remote radius server

     # Get the request code from the proxy reply.
     my $code = $p->code;
&main::log($main::LOG_DEBUG, "radius replied with $code");
     # default to reject
     $op->{RadiusResult} = $main::REJECT;

     # Only proxy if the current request was accepted
     if ($code eq 'Access-Accept') {
         # Set the correct reply code in the reply packet
         # or if the AuthBy is undefined set to Access-Reject.

         # Find the AuthBy clause with the same Identifier
         my $identifier = 'identifier-of-second-authby-radius';
         my $authby = Radius::AuthGeneric::find($identifier);
&main::log($main::LOG_DEBUG, "Found Handler with Identifier $identifier")
             if defined $authby;

         if (defined $authby) {
             # filter the attributes sent to the second radius server
             my @proxied_attrs = qw/
                 Framed-IP-Address
             /;
             for my $attr (@proxied_attrs) {
                 my $value = $p->get_attr($attr);
                 $op->add_attr($attr, $value);
             }

&main::log($main::LOG_DEBUG, Dumper($rp->{Attributes}));

             # Call handle_request for this AuthBy HANDLER
             my ($rc, $reason) = $authby->handle_request($op, $rp);

             $op->{RadiusResult} = $main::IGNORE;
         }
         else {
&main::log($main::LOG_ERR, "No AuthBy with Identifier $identifier");
             $op->{RadiusResult} = $main::REJECT;
         }
     }
     # we don't need to forward the accounting response to the first 
radius server
     elsif ($code eq 'Accounting-Response') {
     }
     else {
&main::log($main::LOG_ERR, "radius server didn't accept the request");
     }
     return;
}

You configure the second radius server in your global radiator config 
with an AuthBy and give it the identifier used in the hook.
This AuthBy has a ReplyHook:

use strict;
use warnings;

# this is needed to respond to the original request from the radius client
sub {
     my $p  = ${$_[0]};  # proxy reply packet
     my $rp = ${$_[1]};  # reply packet to NAS
     my $op = ${$_[2]};  # original request packet
     my $sp = ${$_[3]};  # packet sent to proxy

     # Get the request code from the proxy reply.
     my $code = $p->code;

     # Set the correct reply code in the reply packet
     if ($code eq 'Access-Accept') {
         $op->{RadiusResult} = $main::ACCEPT;
     }
     else {
         $op->{RadiusResult} = $main::REJECT;
     }
     return;
}

...and a NoReplyHook:

use strict;
use warnings;

sub {
     my $p = ${$_[0]};
     my $fp = ${$_[1]};
     my $rp = ${$_[2]};

     $rp->set_code('Access-Accept');

     # reply to the Client that sent the request
     $p->{Client}->replyTo($p);
     return;
}

@list: please feel free to suggest improvements or simplification if 
possible!

Best regards, Alex

Am 2011-11-25 00:37, schrieb Judy Angel:
> Have you solved the multi hosts config in another way?
> Judy
>
> --On 24 November 2011 16:51 +0100 Alexander Hartmaier 
> <alexander.hartmaier at t-systems.at> wrote:
>
>> Synchronous will block the Radiator process until a reply is received or
>> the configured timeout is exceeded. During this time Radiator won't
>> handle any other requests and will be marked as unreachable by the 
>> radius
>> clients if their timeout*retry is lower than the combined timeout*retry
>> of the AuthBy RADIUS clauses.
>>
>> I strongly recommend to *NOT* use Synchronous, *EVER*.
>>
>> Best regards, Alexander Hartmaier
>>
>> Am 2011-11-23 02:21, schrieb Martin Burton:
>>
>>
>> Oops, forgot one important keyword in there.  You need to put the
>> Synchronous flag in the AuthBy RADIUS clause for host1.  If you don't
>> then Radiator will move onto the next AuthBy without waiting for a 
>> reply.
>>
>> <AuthBy RADIUS>
>> <Host host1.herts.ac.uk>
>>              Secret xxxx
>> </Host>
>>      Synchronous
>> </AuthBy>
>>
>>
>> Check the info in the Radiator manual about the implications of using
>> Synchronous though.
>>
>> Cheers,
>>
>> Martin.
>>
>> On 23/11/2011 01:10, Martin Burton wrote:
>>
>>
>>
>> You could probably achieve what you need using an AuthByPolicy, like:
>>
>> <Handler Realm= domain.ac.uk>
>>     RewriteUsername s/^([^@]+).*/$1/
>>     AuthByPolicy ContinueWhileReject
>> <AuthBy RADIUS>
>> <Host host1.herts.ac.uk>
>>             Secret xxxx
>> </Host>
>> </AuthBy>
>> <AuthBy RADIUS>
>> <Host host2.herts.ac.uk>
>>             Secret xxxxx
>> </Host>
>> </AuthBy>
>>     # Log accounting to the detail file in LogDir
>>     AcctLogFileName %L/detail
>> </Handler>
>>
>> HTH.
>>
>>
>> On 23/11/2011 00:01, Judy Angel wrote:
>>
>>
>>
>>
>> Radius V4.2.
>> I am looking to authenticate on two servers. If the userid is not
>> available  in host1 try host2. The config below works fine on host1 but
>> if the return  fails as the userid does not exist it does not check for
>> the userid in  host2. Should this be possible?
>>
>>
>> <Handler Realm= domain.ac.uk>
>>         RewriteUsername s/^([^@]+).*/$1/
>> <AuthBy RADIUS>
>>
>> <Host host1.herts.ac.uk>
>>                 Secret xxxx
>> </Host>
>> <Host host2.herts.ac.uk>
>>                 Secret xxxxx
>> </Host>
>> </AuthBy>
>>       # Log accounting to the detail file in LogDir
>>     AcctLogFileName %L/detail
>> </Handler>
>>
>> Thanks
>> Judy Angel
>> University of Hertfordshire
>>
>> _______________________________________________
>> radiator mailing list
>> radiator at open.com.au
>> http://www.open.com.au/mailman/listinfo/radiator
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> radiator mailing list
>> radiator at open.com.au
>> http://www.open.com.au/mailman/listinfo/radiator
>>
>>
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> radiator mailing list
>> radiator at open.com.au
>> http://www.open.com.au/mailman/listinfo/radiator
>>
>>
>>
>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"* 
>>
>> "*"* T-Systems Austria GesmbH Rennweg 97-99, 1030 Wien
>> Handelsgericht Wien, FN 79340b
>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"* 
>>
>> "*"* Notice: This e-mail contains information that is confidential and
>> may be privileged. If you are not the intended recipient, please notify
>> the sender and then delete this e-mail immediately.
>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"* 
>>
>> "*"*
>
>


More information about the radiator mailing list