Re: Question about processing multiple authorization sources

2006-03-16 Thread Will Saxon 
Replying to my own post...

On Thu, 2006-03-16 at 11:25 -0500, Will Saxon wrote:

> Is it possible to have FreeRADIUS check a separate user database to
> provide the additional attributes? It seems like I could write a script
> to take the username, perform some database queries and return the
> appropriate information, but beyond that I don't know how to go about
> implementing such a solution. 


Nevermind, I have figured it out.

You just have to set up the sql module and insert it after the ldap
module in the authorize stanza. The user has to exist in the radcheck
table and have the 3 attributes (tunnel-type, tunnel-medium-type and
tunnel-private-group-id) set in the radreply table.

-Will

-- 
Will Saxon
Systems Programmer - Network Services
University of Florida Department of Housing
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Question about processing multiple authorization sources

2006-03-16 Thread Will Saxon 
Hello,

I am using FreeRADIUS 1.1.0 on FreeBSD 6.0 with Cisco Aironet 1200
WAPs. 

I need to be able to control which VLAN my users are assigned to, and it
seems like this is accomplished by setting three RADIUS user attributes
which control the assigned vlan after authentication. The problem is
that my authorization/authentication source is an LDAP server, which I
don't have any control over, that does not contain these attributes. 

Is it possible to have FreeRADIUS check a separate user database to
provide the additional attributes? It seems like I could write a script
to take the username, perform some database queries and return the
appropriate information, but beyond that I don't know how to go about
implementing such a solution. 

If it matters, I am currently using EAP-TTLS/PAP with SecureW2 and the
aforementioned LDAP server.

-Will

-- 
Will Saxon
Systems Programmer - Network Services
University of Florida Department of Housing
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html