2 # ABFAB Trust router policies.
12 if (TLS-PSK-Identity) {
13 # TODO: may need to check trust-router-apc as well
14 if ("%{psksql:select distinct keyid from authorizations_keys where keyid = '%{tls-psk-identity}' and '%{trust-router-coi}' like coi and '%{gss-acceptor-realm-name}' like acceptor_realm and '%{gss-acceptor-host-name}' like hostname;}") {
19 Reply-Message = "RP not authorized for this ABFAB request"
27 # check that the acceptor host name is correct
28 if ("%{client:gss_acceptor_host_name}" && &gss-acceptor-host-name) {
29 if ("%{client:gss_acceptor_host_name}" != "%{gss-acceptor-host-name}") {
31 Reply-Message = "GSS-Acceptor-Host-Name incorrect"
37 # set trust-router-coi attribute from the client configuration
38 if ("%{client:trust_router_coi}") {
40 Trust-Router-COI := "%{client:trust_router_coi}"
44 # set gss-acceptor-realm-name attribute from the client configuration
45 if ("%{client:gss_acceptor_realm_name}") {
47 GSS-Acceptor-Realm-Name := "%{client:gss_acceptor_realm_name}"
52 # A policy which is used to validate channel-bindings.
54 abfab_channel_bindings {
55 if (GSS-Acceptor-Service-Name && (outer.request:GSS-Acceptor-Service-Name != GSS-Acceptor-Service-Name)) {
59 if (GSS-Acceptor-Host-Name && outer.request:GSS-Acceptor-Host-Name != GSS-Acceptor-Host-Name ) {
63 if (GSS-Acceptor-Realm-Name && outer.request:GSS-Acceptor-Realm-Name != GSS-Acceptor-Realm-Name ) {
67 if (GSS-Acceptor-Service-Name || GSS-Acceptor-Realm-Name || GSS-Acceptor-Host-Name) {
69 Chbind-Response-Code := success
73 # ACK the attributes in the request.
75 # If any one of these attributes don't exist in the request,
76 # then they won't be copied to the reply.
79 GSS-Acceptor-Service-Name = &GSS-Acceptor-Service-Name
80 GSS-Acceptor-Host-Name = &GSS-Acceptor-Host-Name
81 GSS-Acceptor-Realm-Name = &GSS-Acceptor-Realm-Name
86 # Return "handled" so that the "authenticate" section isn't used.