I've run into a dead end while trying to set up customized attributes as a reply item (I want custom information added to the "access accept" packet). While trying to achieve this I came across this entry:
# If you want to add entries to the dictionary file,
# which are NOT going to be placed in a RADIUS packet,
# add them to the 'dictionary.local' file.
#
# The numbers you pick should be between 3000 and 4000.
# These attributes will NOT go into a RADIUS packet.
#
# If you want that, you will need to use VSAs. This means
# requesting allocation of a Private Enterprise Code from
# http://iana.org. We STRONGLY suggest doing that only if
# you are a vendor of RADIUS equipment.
#
# See RFC 6158 for more details.
# http://ietf.org/rfc/rfc6158.txt
So I understand how the usual approach should be.
However my infrastructure is set up in stages and the radius server in question is already placed on the "inside", so I don't see why I shouldn't be able to set or overwrite unused attributes on both ends of this second inteal authentication step.
Googleing around I found several threads on how to set this type of thing up with a users-file based approach on 1.x versions of Freeradius, not so much for any of the newer releases.
Is what I'm proposing still possible with freeradius-server-3.0.10 ? And if so, how should I go about implementing this?
Current state: I've added my attribute "faculty" to the dictionary (mapping the set integer from the DB to a string set in directory ie. Ei & MECH) and the respective DB, causing the radius server to find and evaluate the attribute set in "radreply" (here: := MECH) and "radgroupreply" (here += EI).
...
rlm_sql (sql1): Reserved coection (5)
(1) sql1: EXPAND SELECT id, useame, attribute, value, op FROM radcheck WHERE useame = '%{SQL-User-Name}' AND active > '0' AND active < '3' ORDER BY id(1) sql1: --> SELECT id, useame, attribute, value, op FROM radcheck WHERE useame = '*useame*' AND active > '0' AND active < '3' ORDER BY id
(1) sql1: Executing select query: SELECT id, useame, attribute, value, op FROM radcheck WHERE useame = '*useame*' AND active > '0' AND active < '3'ORDER BY id
(1) sql1: User found in radcheck table
(1) sql1: Conditional check items matched, merging assignment check items
(1) sql1: Cleartext-Password := "*password*"
(1) sql1: EXPAND SELECT id, useame, attribute, value, op FROM radreply WHERE useame = '%{SQL-User-Name}' ORDER BY id
(1) sql1: --> SELECT id, useame, attribute, value, op FROM radreply WHERE useame = '*useame*' ORDER BY id
(1) sql1: Executing select query: SELECT id, useame, attribute, value, op FROM radreply WHERE useame = '*useame*' ORDER BY id
(1) sql1: User found in radreply table, merging reply items
(1) sql1: faculty := MECH
(1) sql1: EXPAND SELECT groupname FROM radusergroup WHERE useame = '%{SQL-User-Name}' ORDER BY priority
(1) sql1: --> SELECT groupname FROM radusergroup WHERE useame = '*useame*' ORDER BY priority
(1) sql1: Executing select query: SELECT groupname FROM radusergroup WHERE useame = '*useame*' ORDER BY priority
(1) sql1: User found in the group table
(1) sql1: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id
(1) sql1: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vid100' ORDER BY id
(1) sql1: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vid100' ORDER BY id
(1) sql1: Group "vid100": Conditional check items matched
(1) sql1: Group "vid100": Merging assignment check items
(1) sql1: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id
(1) sql1: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vid100' ORDER BY id
(1) sql1: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vid100' ORDER BY id
(1) sql1: Group "vid100": Merging reply items
(1) sql1: Tuel-Type = VLAN
(1) sql1: Tuel-Medium-Type = IEEE-802
(1) sql1: Tuel-Private-Group-Id = "100"
(1) sql1: faculty += EI
rlm_sql (sql1): Released coection (5)
...
The keen observer will also notice some changes to the "radcheck" query, but this change is not related to the topic at hand. So the Server gets the information, however I've not found a way to include it to the reply yet.
(1) Sent Access-Accept Id 81 from **IP-Radius-server**:*port* to **IP-supplicant**:*port* length 0
(1) Tuel-Type = VLAN
(1) Tuel-Medium-Type = IEEE-802
(1) Tuel-Private-Group-Id = "100"
(1) Finished request
Any help or pointers would be appreciated :) Felix