Re: EAP processing again

2012-06-13 Thread Alan DeKok
Emmanuel BILLOT wrote: > I will not understand all, but i think (i hope) i can roughly follow the > mechanism. I often try to known what a product do for configuring it. > Maybe it is a mistake... It's often a mistake. Explanations complex ideas often means getting deep into secondary topics.

Re: Re : Re: EAP processing

2012-06-13 Thread Matthew Newton
On Tue, Jun 12, 2012 at 08:11:17PM +0200, Billot wrote: > It begins with a a complete request, and the authorize section. > Parsing each authorize mechanism, only eap doesn't return "noops". > > A first question : the default file says > > eap { >  return ok > } > > EAP request comes with EAP me

Re: EAP processing again

2012-06-13 Thread Emmanuel BILLOT
understand. ... # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 61 [ttls] Length Included [ttls] e

Re: EAP processing again

2012-06-13 Thread Alan DeKok
Emmanuel BILLOT wrote: > Ok i read all of the debug output, and i think i can understand > mechanism. However could you confirm (or not) what i understand ? I'm trying to figure out why you need to understand it. The details of the EAP flow are complex. You don't need to understand them. You

EAP processing again

2012-06-13 Thread Emmanuel BILLOT
Hi, Ok i read all of the debug output, and i think i can understand mechanism. However could you confirm (or not) what i understand ? In case of an EAP/TTLS connexion : - Freeradius get a request, with a particular attribut : EAP-Message - Entering authorize section, only EAP one matches beca

Re: Re : Re: EAP processing

2012-06-12 Thread Alan DeKok
Billot wrote: > A first question : the default file says > > eap { > return ok > } > > EAP request comes with EAP message and is so captured by the eap > authorize section, right ? > It returns an update of the original request with Auth-Type = EAP Yes. > I can't understand why there is then

Re : Re: EAP processing

2012-06-12 Thread Billot
Le 12/06/12, Alan DeKok a écrit : > Emmanuel BILLOT wrote: > > Could you explain what is the difference between the default file and > > the inner-tunnel file in /etc/raddb/site-enabled ? > > This is documented in the comments at the top of the files. > > The "default" virtual server handle

Re: EAP processing

2012-06-12 Thread Alan DeKok
Emmanuel BILLOT wrote: > Could you explain what is the difference between the default file and > the inner-tunnel file in /etc/raddb/site-enabled ? This is documented in the comments at the top of the files. The "default" virtual server handles normal RADIUS traffic. However, some EAP types

EAP processing

2012-06-12 Thread Emmanuel BILLOT
Hi, Could you explain what is the difference between the default file and the inner-tunnel file in /etc/raddb/site-enabled ? When running in debug mode, i see sometimes # Executing section authorize from file /etc/raddb/sites-enabled/default and sometimes # Executing section authorize from file