Hi,
> On 17 Jan 2018, at 1.00, Johnson, Neil M <[email protected]> wrote:
>
> The problem is I have 16 different types of equipment that require different
> RADIUS attribute values returned, depending on the user.
>
> i.e A user may get read-only access to equipment type A, but need full-access
> to equipment type B.
>
> Am I going to have to setup 16 different handlers, and 16 different flat
> files?
>
> Any suggestions on a better way to do that?
>
one solution could be to use AuthBy SQL with SQLite database file to select
and return wanted attributes.
E.g.
# Assume that users have been already authenticated by some previous AuthBy
# Return per user/device reply attributes
<AuthBy SQL>
Identifier AuthBy-SQL-Local-SQLite
# Do not authenticate users anymore
NoCheckPassword
# Ignore accounting
IgnoreAccounting
# SQLite db file location
DBSource dbi:SQLite:dbname=/etc/radiator/reply_items.db
# SQL select query to get reply attributes based on <Client> stanza’s
Identifier and User-Name
# REPLYATTRS column contains a list of reply attributes separated by a comma
# E.g. Attribute1=100,Attribute2=“some value”,...
AuthSelect select REPLYATTRS from USERS where
CLIENT_ID=%{Client:Identifier} and USERNAME=%0
AuthColumnDef 0, GENERIC, reply
</AuthBy>
Example SQLite schema
create table USERS (
CLIENT_ID varchar(50),
USERNAME varchar(50),
REPLYATTRS varchar(200)
);
create index idx_client_id_username on USERS (CLIENT_ID, USERNAME);
-- example user mikem
insert into USERS (
CLIENT_ID,
USERNAME,
REPLYATTRS
)
values (
'Cisco-routers',
'mikem',
'cisco-avpair= "shell:priv-lvl=15"'
);
Group memberships could be implemented by having multiple tables and joining
them in AuthSelect query.
BR
--
Tuure Vartiainen <[email protected]>
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP, TNC, WiMAX, RSA, Vasco, Yubikey, MOTP, HOTP, TOTP,
DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS,
NetWare etc.
_______________________________________________
radiator mailing list
[email protected]
http://lists.open.com.au/mailman/listinfo/radiator
