FreeRADIUS / freeradius-server

FreeRADIUS - A multi-protocol policy server.
http://freeradius.org
GNU General Public License v2.0
2.13k stars 1.08k forks source link

[defect]: Broadband Authentication Request Failure for New Realm #5463

Closed e03shiranr closed 2 hours ago

e03shiranr commented 3 hours ago

What type of defect/bug is this?

Unexpected behaviour (obvious or verified by project member)

How can the issue be reproduced?

I am not sure whether you are able to reproduce the issue. However I have attached the configuration.docx configuration detail as a file.

As per the config

  1. if I use sltbb realm proxy server pass the authentication request to proxy server
  2. if I use sltftth realm proxy server send authentication reject with "Your domain is invalid".

Log output from the FreeRADIUS daemon

Failed Scenario
=================
rad_recv: Access-Request packet from host 203.0.113.27 port 1812, id=0, length=108
        User-Name = "94112432473@sltftth"
        User-Password = "2432473"
        NAS-IP-Address = 203.0.113.27
        Service-Type = Framed-User
        Framed-Protocol = PPP
        NAS-Identifier = "CC_X16_CEA_A2"
        NAS-Port-Type = Ethernet
        Acct-Session-Id = "05107404"
server sltbb {
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/sltbb
+- entering group authorize {...}
++[preprocess] returns ok
rlm_perl: Added pair NAS-Port-Type = Ethernet
rlm_perl: Added pair Acct-Session-Id = 05107404
rlm_perl: Added pair Service-Type = Framed-User
rlm_perl: Added pair Framed-Protocol = PPP
rlm_perl: Added pair User-Name = 94112432473@SLTFTTH
rlm_perl: Added pair User-Password = 2432473
rlm_perl: Added pair NAS-Identifier = CC_X16_CEA_A2
rlm_perl: Added pair NAS-IP-Address = 203.0.113.27
++[perl_authorize_sltbb] returns updated
[suffix] Looking up realm "SLTFTTH" for User-Name = "94112432473@SLTFTTH"
[suffix] Found realm "DEFAULT"
[suffix] Adding Stripped-User-Name = "94112432473"
[suffix] Adding Realm = "DEFAULT"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[files_sltbb] users: Matched entry DEFAULT at line 206
[files_sltbb] users: Matched entry DEFAULT at line 263
++[files_sltbb] returns ok
} # server sltbb
Using Post-Auth-Type Reject
# Executing group from file /usr/local/etc/raddb/sites-enabled/sltbb
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> 94112432473@SLTFTTH
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.1 seconds.

success scenario
==============
rad_recv: Access-Request packet from host 203.0.113.27 port 1812, id=0, length=108
        User-Name = "94212214233@sltbb"
        User-Password = "2214233"
        NAS-IP-Address = 203.0.113.27
        Service-Type = Framed-User
        Framed-Protocol = PPP
        NAS-Identifier = "CC_X16_CEA_A2"
        NAS-Port-Type = Ethernet
        Acct-Session-Id = "05107404"
server sltbb {
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/sltbb
+- entering group authorize {...}
++[preprocess] returns ok
rlm_perl: Added pair NAS-Port-Type = Ethernet
rlm_perl: Added pair Acct-Session-Id = 05107404
rlm_perl: Added pair Service-Type = Framed-User
rlm_perl: Added pair Framed-Protocol = PPP
rlm_perl: Added pair User-Name = 94212214233@SLTBB
rlm_perl: Added pair User-Password = 2214233
rlm_perl: Added pair NAS-Identifier = CC_X16_CEA_A2
rlm_perl: Added pair NAS-IP-Address = 203.0.113.27
++[perl_authorize_sltbb] returns updated
[suffix] Looking up realm "SLTBB" for User-Name = "94212214233@SLTBB"
[suffix] Found realm "sltbb"
[suffix] Adding Stripped-User-Name = "94212214233"
[suffix] Adding Realm = "sltbb"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[files_sltbb] users: Matched entry DEFAULT at line 206
[files_sltbb] users: Matched entry DEFAULT at line 210
++[files_sltbb] returns ok
} # server sltbb
  WARNING: Empty pre-proxy section.  Using default return values.
Sending Access-Request of id 212 to 192.168.3.113 port 11812

Relevant log output from client utilities

No response

Backtrace from LLDB or GDB

No response

alandekok commented 2 hours ago

It helps to read the documentation. In this case, the documentation for github issues says "configuration questions belong on the mailing list".

Plus, adding the configuration files as a docx file, versus just plain text? There's no reason to use docx