Re: update NAS-Identifier in Access-Request before proxying to other radius server

2012-06-05 Thread C.F. Yeung
Have changed the unlang as follow. update request { NAS-Identifier := new-nas-identifier } Tried put it under authorize, pre-proxy or post-proxy, nothing changed. On Tue, Jun 5, 2012 at 2:45 PM, Alan DeKok al...@deployingradius.comwrote: C.F. Yeung wrote: I

Re: update NAS-Identifier in Access-Request before proxying to other radius server

2012-06-05 Thread C.F. Yeung
Thanks Alan, I have figured out the problem. On Tue, Jun 5, 2012 at 5:00 PM, Alan DeKok al...@deployingradius.comwrote: C.F. Yeung wrote: Have changed the unlang as follow. update request { NAS-Identifier := new-nas-identifier } Tried put it under

update NAS-Identifier in Access-Request before proxying to other radius server

2012-06-04 Thread C.F. Yeung
I want to update NAS-Identifier in Access-Request before proxying to other radius server. Tried adding the following lines in default but in vain. So, where should I put the following unlang? update request { NAS-Identifier = new-nas-identifier } - List

Re: 2 Certs for 2 SSID (802.1x)

2012-05-21 Thread C.F. Yeung
Thanks Matthew, it's tested okay. On Fri, May 18, 2012 at 5:44 PM, Matthew Newton m...@leicester.ac.ukwrote: On Fri, May 18, 2012 at 11:35:39AM +0800, C.F. Yeung wrote: Sorry to bother again, how should I rewrite the unlang for the condition that if the Called-Station-Id contains eduroam

Re: Reject users based on LDAP attribute

2012-05-17 Thread C.F. Yeung
Thanks, it's working. On Thu, May 17, 2012 at 3:22 PM, Phil Mayers p.may...@imperial.ac.ukwrote: On 05/17/2012 06:54 AM, C.F. Yeung wrote: We have 802.1x authentication via AD. It's okay. Now, we would like to reject users based on LDAP attribute, WLANStatus. Added attribute in dictionary

Re: 2 Certs for 2 SSID (802.1x)

2012-05-17 Thread C.F. Yeung
Thanks Phil, it's ok now. On Thu, May 17, 2012 at 3:14 PM, Phil Mayers p.may...@imperial.ac.ukwrote: On 05/17/2012 05:07 AM, C.F. Yeung wrote: I have added a new eap_new with the other cert in eap.conf and tried the unlang policy. But, it still goes to my existing eap/cert. MAC address

Re: 2 Certs for 2 SSID (802.1x)

2012-05-17 Thread C.F. Yeung
Thanks Alan, it's fixed with the help by Phil. I want to add one more condition to call the eap_new module based on Realm. The following elseif condition is wrong. How should I write the correct unlang? if(Called-Station-Id == xx-xx-xx-xx-xx-xx:duroam) { eap_new {

Re: 2 Certs for 2 SSID (802.1x)

2012-05-17 Thread C.F. Yeung
} } else { eap { ok = return } } On Fri, May 18, 2012 at 9:11 AM, C.F. Yeung yeun...@gmail.com wrote: Thanks Alan, it's fixed with the help by Phil. I want to add one more condition to call the eap_new module based

Re: 2 Certs for 2 SSID (802.1x)

2012-05-17 Thread C.F. Yeung
Sorry to bother again, how should I rewrite the unlang for the condition that if the Called-Station-Id contains eduroam? if (Called-Station-Id == xx-xx-xx-xx-xx-xx:eduroam) { On Fri, May 18, 2012 at 10:38 AM, C.F. Yeung yeun...@gmail.com wrote: Got it working as follow. if (Called

2 Certs for 2 SSID (802.1x)

2012-05-16 Thread C.F. Yeung
We have 2 SSL Certs for two SSID (802.1x). How can my freeradius server present wifi clients the cert based on SSID? Should I have two eap.conf? Thanks, CF - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: 2 Certs for 2 SSID (802.1x)

2012-05-16 Thread C.F. Yeung
= 0x0106004119001403010001011603010030b28ae1644d58446a53a87038624720d385694e46bdc3ed64cc1db984d2b701c2c108d53dd42f6b1cda054ca078d222ec Message-Authenticator = 0x State = 0x96c69e6392c08707519378ef521f03bb Proxy-State = 0x3637 Finished request 4. On Wed, May 16, 2012 at 11:46 PM, Phil Mayers p.may...@imperial.ac.ukwrote: On 16/05/12 16:29, C.F

Reject users based on LDAP attribute

2012-05-16 Thread C.F. Yeung
We have 802.1x authentication via AD. It's okay. Now, we would like to reject users based on LDAP attribute, WLANStatus. Added attribute in dictionary and ldap.attrmap as follow. Where should I put the unlang? /etc/raddb/dictionary ATTRIBUTE My-Local-wlanStatus 3000string