FreeRadius SQL authorization and perl authentication
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
Is it possible to achieve with FreeRadius something like this?
Check if a user is in SQL table:
- if yes: authenticate with Perl module
- if no: deny access
I studied the wiki and the FreeRadius SQL how to. As far as I understand, if you add users to radcheck, you need to have the password there, too. The SQL module handles the whole authentication process using a SQL database and this is not what I want to achieve.
freeradius
edited Jun 27 at 7:49
SivaPrasath
3,88611737
asked Jun 27 at 6:30
Bogdan-Mihai
31
add a comment |Â
up vote
0
down vote
favorite
Is it possible to achieve with FreeRadius something like this?
Check if a user is in SQL table:
- if yes: authenticate with Perl module
- if no: deny access
I studied the wiki and the FreeRadius SQL how to. As far as I understand, if you add users to radcheck, you need to have the password there, too. The SQL module handles the whole authentication process using a SQL database and this is not what I want to achieve.
freeradius
edited Jun 27 at 7:49
SivaPrasath
3,88611737
asked Jun 27 at 6:30
Bogdan-Mihai
31
What exactly are you trying to achieve? The SQL module is the easiest implementation... with perl to authenticate you'll still need the query result... see Run SQL statements
– eyoung100
Jun 27 at 6:46
I want to store only the usernames in SQL. User tries to authenticate on a portal, sends info to radius, check SQL if user exists, if it is there, pass the authentication to a perl module that will do it's magic with an external server. Basically, an authorization.
– Bogdan-Mihai
Jun 27 at 6:53
You'll still need a query result from somewhere to send to freeradius. You're doing the authentication backwards. Read RADIUS Concepts. If the entire cycle passes freeradius then authenticate the user on the portal, using the portals database not free radius. If the user exists in free radius but not on the portal, you inadvertently created a backdoor.
– eyoung100
Jun 27 at 7:04
I would prefer using unlang than perl for doing such thing in FreeRadius. However, actually FR has a well defined method and tables for MySQL, and you do not need perl at all. You should however, check their user group and their manual. It is easier than inventing stuff.
– Rui F Ribeiro
Jun 27 at 8:02
Thank you two for your interest in my question! I have a Cisco VPN where I do 2 factor authentication (VPN>Radius+Perl module>2FA solution). In order to restrict the roles of specific users I need to pass a certain radius attribute to the Cisco VPN for a pool of 100 users, something like memberOf. I wanted to do the authorization with sql and then pass the authentication to perl module so I will authenticate and generate the one time password there. If you are thinking at any other way of doing this, I am opened to suggestions.Maybe I can only manualy set a radius attribute in the reply?
– Bogdan-Mihai
Jul 2 at 12:32
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Is it possible to achieve with FreeRadius something like this?
Check if a user is in SQL table:
- if yes: authenticate with Perl module
- if no: deny access
I studied the wiki and the FreeRadius SQL how to. As far as I understand, if you add users to radcheck, you need to have the password there, too. The SQL module handles the whole authentication process using a SQL database and this is not what I want to achieve.
freeradius
edited Jun 27 at 7:49
SivaPrasath
3,88611737
asked Jun 27 at 6:30
Bogdan-Mihai
31
Is it possible to achieve with FreeRadius something like this?
Check if a user is in SQL table:
- if yes: authenticate with Perl module
- if no: deny access
I studied the wiki and the FreeRadius SQL how to. As far as I understand, if you add users to radcheck, you need to have the password there, too. The SQL module handles the whole authentication process using a SQL database and this is not what I want to achieve.
freeradius
edited Jun 27 at 7:49
SivaPrasath
3,88611737
asked Jun 27 at 6:30
Bogdan-Mihai
31
edited Jun 27 at 7:49
SivaPrasath
3,88611737
edited Jun 27 at 7:49
SivaPrasath
3,88611737
edited Jun 27 at 7:49
SivaPrasath
3,88611737
3,88611737
asked Jun 27 at 6:30
Bogdan-Mihai
31
asked Jun 27 at 6:30
Bogdan-Mihai
31
asked Jun 27 at 6:30
Bogdan-Mihai
31
31
What exactly are you trying to achieve? The SQL module is the easiest implementation... with perl to authenticate you'll still need the query result... see Run SQL statements
– eyoung100
Jun 27 at 6:46
I want to store only the usernames in SQL. User tries to authenticate on a portal, sends info to radius, check SQL if user exists, if it is there, pass the authentication to a perl module that will do it's magic with an external server. Basically, an authorization.
– Bogdan-Mihai
Jun 27 at 6:53
You'll still need a query result from somewhere to send to freeradius. You're doing the authentication backwards. Read RADIUS Concepts. If the entire cycle passes freeradius then authenticate the user on the portal, using the portals database not free radius. If the user exists in free radius but not on the portal, you inadvertently created a backdoor.
– eyoung100
Jun 27 at 7:04
I would prefer using unlang than perl for doing such thing in FreeRadius. However, actually FR has a well defined method and tables for MySQL, and you do not need perl at all. You should however, check their user group and their manual. It is easier than inventing stuff.
– Rui F Ribeiro
Jun 27 at 8:02
Thank you two for your interest in my question! I have a Cisco VPN where I do 2 factor authentication (VPN>Radius+Perl module>2FA solution). In order to restrict the roles of specific users I need to pass a certain radius attribute to the Cisco VPN for a pool of 100 users, something like memberOf. I wanted to do the authorization with sql and then pass the authentication to perl module so I will authenticate and generate the one time password there. If you are thinking at any other way of doing this, I am opened to suggestions.Maybe I can only manualy set a radius attribute in the reply?
– Bogdan-Mihai
Jul 2 at 12:32
add a comment |Â
What exactly are you trying to achieve? The SQL module is the easiest implementation... with perl to authenticate you'll still need the query result... see Run SQL statements
– eyoung100
Jun 27 at 6:46
I want to store only the usernames in SQL. User tries to authenticate on a portal, sends info to radius, check SQL if user exists, if it is there, pass the authentication to a perl module that will do it's magic with an external server. Basically, an authorization.
– Bogdan-Mihai
Jun 27 at 6:53
You'll still need a query result from somewhere to send to freeradius. You're doing the authentication backwards. Read RADIUS Concepts. If the entire cycle passes freeradius then authenticate the user on the portal, using the portals database not free radius. If the user exists in free radius but not on the portal, you inadvertently created a backdoor.
– eyoung100
Jun 27 at 7:04
I would prefer using unlang than perl for doing such thing in FreeRadius. However, actually FR has a well defined method and tables for MySQL, and you do not need perl at all. You should however, check their user group and their manual. It is easier than inventing stuff.
– Rui F Ribeiro
Jun 27 at 8:02
Thank you two for your interest in my question! I have a Cisco VPN where I do 2 factor authentication (VPN>Radius+Perl module>2FA solution). In order to restrict the roles of specific users I need to pass a certain radius attribute to the Cisco VPN for a pool of 100 users, something like memberOf. I wanted to do the authorization with sql and then pass the authentication to perl module so I will authenticate and generate the one time password there. If you are thinking at any other way of doing this, I am opened to suggestions.Maybe I can only manualy set a radius attribute in the reply?
– Bogdan-Mihai
Jul 2 at 12:32
What exactly are you trying to achieve? The SQL module is the easiest implementation... with perl to authenticate you'll still need the query result... see Run SQL statements
– eyoung100
Jun 27 at 6:46
What exactly are you trying to achieve? The SQL module is the easiest implementation... with perl to authenticate you'll still need the query result... see Run SQL statements
– eyoung100
Jun 27 at 6:46
I want to store only the usernames in SQL. User tries to authenticate on a portal, sends info to radius, check SQL if user exists, if it is there, pass the authentication to a perl module that will do it's magic with an external server. Basically, an authorization.
– Bogdan-Mihai
Jun 27 at 6:53
I want to store only the usernames in SQL. User tries to authenticate on a portal, sends info to radius, check SQL if user exists, if it is there, pass the authentication to a perl module that will do it's magic with an external server. Basically, an authorization.
– Bogdan-Mihai
Jun 27 at 6:53
You'll still need a query result from somewhere to send to freeradius. You're doing the authentication backwards. Read RADIUS Concepts. If the entire cycle passes freeradius then authenticate the user on the portal, using the portals database not free radius. If the user exists in free radius but not on the portal, you inadvertently created a backdoor.
– eyoung100
Jun 27 at 7:04
You'll still need a query result from somewhere to send to freeradius. You're doing the authentication backwards. Read RADIUS Concepts. If the entire cycle passes freeradius then authenticate the user on the portal, using the portals database not free radius. If the user exists in free radius but not on the portal, you inadvertently created a backdoor.
– eyoung100
Jun 27 at 7:04
I would prefer using unlang than perl for doing such thing in FreeRadius. However, actually FR has a well defined method and tables for MySQL, and you do not need perl at all. You should however, check their user group and their manual. It is easier than inventing stuff.
– Rui F Ribeiro
Jun 27 at 8:02
I would prefer using unlang than perl for doing such thing in FreeRadius. However, actually FR has a well defined method and tables for MySQL, and you do not need perl at all. You should however, check their user group and their manual. It is easier than inventing stuff.
– Rui F Ribeiro
Jun 27 at 8:02
Thank you two for your interest in my question! I have a Cisco VPN where I do 2 factor authentication (VPN>Radius+Perl module>2FA solution). In order to restrict the roles of specific users I need to pass a certain radius attribute to the Cisco VPN for a pool of 100 users, something like memberOf. I wanted to do the authorization with sql and then pass the authentication to perl module so I will authenticate and generate the one time password there. If you are thinking at any other way of doing this, I am opened to suggestions.Maybe I can only manualy set a radius attribute in the reply?
– Bogdan-Mihai
Jul 2 at 12:32
Thank you two for your interest in my question! I have a Cisco VPN where I do 2 factor authentication (VPN>Radius+Perl module>2FA solution). In order to restrict the roles of specific users I need to pass a certain radius attribute to the Cisco VPN for a pool of 100 users, something like memberOf. I wanted to do the authorization with sql and then pass the authentication to perl module so I will authenticate and generate the one time password there. If you are thinking at any other way of doing this, I am opened to suggestions.Maybe I can only manualy set a radius attribute in the reply?
– Bogdan-Mihai
Jul 2 at 12:32
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f452151%2ffreeradius-sql-authorization-and-perl-authentication%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
What exactly are you trying to achieve? The SQL module is the easiest implementation... with perl to authenticate you'll still need the query result... see Run SQL statements
– eyoung100
Jun 27 at 6:46
I want to store only the usernames in SQL. User tries to authenticate on a portal, sends info to radius, check SQL if user exists, if it is there, pass the authentication to a perl module that will do it's magic with an external server. Basically, an authorization.
– Bogdan-Mihai
Jun 27 at 6:53
You'll still need a query result from somewhere to send to freeradius. You're doing the authentication backwards. Read RADIUS Concepts. If the entire cycle passes freeradius then authenticate the user on the portal, using the portals database not free radius. If the user exists in free radius but not on the portal, you inadvertently created a backdoor.
– eyoung100
Jun 27 at 7:04
I would prefer using unlang than perl for doing such thing in FreeRadius. However, actually FR has a well defined method and tables for MySQL, and you do not need perl at all. You should however, check their user group and their manual. It is easier than inventing stuff.
– Rui F Ribeiro
Jun 27 at 8:02
Thank you two for your interest in my question! I have a Cisco VPN where I do 2 factor authentication (VPN>Radius+Perl module>2FA solution). In order to restrict the roles of specific users I need to pass a certain radius attribute to the Cisco VPN for a pool of 100 users, something like memberOf. I wanted to do the authorization with sql and then pass the authentication to perl module so I will authenticate and generate the one time password there. If you are thinking at any other way of doing this, I am opened to suggestions.Maybe I can only manualy set a radius attribute in the reply?
– Bogdan-Mihai
Jul 2 at 12:32