inverse-inc / packetfence

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.
https://packetfence.org
GNU General Public License v2.0
1.35k stars 286 forks source link

web admin(switch templates): allow to add a RADIUS attribute not part of dictionnaries #6025

Open nqb opened 3 years ago

nqb commented 3 years ago

Is your feature request related to a problem? Please describe. When you want to custom a switch template from GUI, you may want to add a RADIUS attribute which is not part of built-in dictionnary. Currently, it's not possible.

Describe the solution you'd like For RADIUS attributes support both methods:

like we have for SSID when using a filter on a Connection profile.

nqb commented 3 years ago

I was thinking that I can workaround this issue by editing template_switches.conf and adding my own attribute but it doesn't work.

I got following error message in packetfence.log with HW-Ext-Specific as RADIUS attribute:

pfperl-api(5688) WARN: Unknown RADIUS tuple HW-Ext-Specific => 2                                                                                                          
 at /usr/local/pf/lib/pf/util/radius.pm line 135.                                                                                                                                                                
 (Carp::carp)

I suppose it's caused by the fact that we create a RADIUS request by using a dictionnary here and my attribute is not added here.

jrouzierinverse commented 3 years ago

There is a lot more involved in this than just adding a name to a list. We would need to know the attribute's numeric id, data type, vendor's name, and vendor id. We would also need to dynamically update the dictionary at runtime.

nqb commented 3 years ago

I want to mention that when you edit template_switches.conf to add your attribute (Don't do that), RADIUS Audit log displays your additional RADIUS attribute like it was sent to network device (which is not the case).

satkunas commented 3 years ago

Reassigning to @nqb for followup.