Add SQL backing to Moonshot-*-TargetedId generation. Added three attributes for gener...

[freeradius.git] / raddb / sites-available / inner-tunnel

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index 0444c62..c1e8ae1 100644 (file)
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -47,6 +47,21 @@ listen {
 #  need to setup hints for the remote radius server
 authorize {
        #
+       #  Take a User-Name, and perform some checks on it, for spaces and other
+       #  invalid characters.  If the User-Name appears invalid, reject the
+       #  request.
+       #
+       #  See policy.d/filter for the definition of the filter_username policy.
+       #
+       filter_username
+
+       #
+       #  Do checks on outer / inner User-Name, so that users
+       #  can't spoof us by using incompatible identities
+       #
+#      filter_inner_identity
+
+       #
        #  The chap module will set 'Auth-Type := CHAP' if we are
        #  handling a CHAP request and Auth-Type has not already been set
        chap
@@ -134,8 +149,8 @@ authorize {
        #
        #  If you are using /etc/smbpasswd, and are also doing
        #  mschap authentication, the un-comment this line, and
-       #  configure the 'etc_smbpasswd' module, above.
-#      etc_smbpasswd
+       #  enable the "smbpasswd" module.
+#      smbpasswd
 
        #
        #  The ldap module reads passwords from the LDAP database.
@@ -207,6 +222,11 @@ authenticate {
        }
 
        #
+       #  For old names, too.
+       #
+       mschap
+
+       #
        #  Pluggable Authentication Modules.
 #      pam
 
@@ -296,11 +316,50 @@ post-auth {
 
 
        #
-       #  Instead of "use_tunneled_reply", do this:
+       #  Un-comment the following if you want to generate Moonshot (ABFAB) TargetedIds
        #
-#      update {
-#              &outer.session-state: += &reply:
-#      }
+       #  IMPORTANT: This requires the UUID package to be installed, and a targeted_id_salt
+       #             to be configured.
+       #
+       #  This functionality also supports SQL backing. To use this functionality, enable
+       #  and configure the moonshot-targeted-ids SQL module in the mods-enabled directory.
+       #  Then remove the comments from the appropriate lines in each of the below
+       #  policies in the policy.d/moonshot-targeted-ids file.
+       #
+#      moonshot_host_tid
+#      moonshot_realm_tid
+#      moonshot_coi_tid
+
+       #
+       #  Instead of "use_tunneled_reply", change this "if (0)" to an
+       #  "if (1)".
+       #
+       if (0) {
+               #
+               #  These attributes are for the inner-tunnel only,
+               #  and MUST NOT be copied to the outer reply.
+               #
+               update reply {
+                       User-Name !* ANY
+                       Message-Authenticator !* ANY
+                       EAP-Message !* ANY
+                       Proxy-State !* ANY
+                       MS-MPPE-Encryption-Types !* ANY
+                       MS-MPPE-Encryption-Policy !* ANY
+                       MS-MPPE-Send-Key !* ANY
+                       MS-MPPE-Recv-Key !* ANY
+               }
+
+               #
+               #  Copy the inner reply attributes to the outer
+               #  session-state list.  The post-auth policy will take
+               #  care of copying the outer session-state list to the
+               #  outer reply.
+               #
+               update {
+                       &outer.session-state: += &reply:
+               }
+       }
 
        #
        #  Access-Reject packets are sent through the REJECT sub-section of the
@@ -318,7 +377,7 @@ post-auth {
                #  Let the outer session know which module failed, and why.
                #
                update outer.session-state {
-                       Module-Failure-Message := &request:Module-Failure-Message
+                       &Module-Failure-Message := &request:Module-Failure-Message
                }
        }
 }
@@ -375,28 +434,6 @@ post-proxy {
        #  reject the EAP request.
        #
        eap
-
-       #
-       #  If the server tries to proxy a request and fails, then the
-       #  request is processed through the modules in this section.
-       #
-       #  The main use of this section is to permit robust proxying
-       #  of accounting packets.  The server can be configured to
-       #  proxy accounting packets as part of normal processing.
-       #  Then, if the home server goes down, accounting packets can
-       #  be logged to a local "detail" file, for processing with
-       #  radrelay.  When the home server comes back up, radrelay
-       #  will read the detail file, and send the packets to the
-       #  home server.
-       #
-       #  With this configuration, the server always responds to
-       #  Accounting-Requests from the NAS, but only writes
-       #  accounting packets to disk if the home server is down.
-       #
-#      Post-Proxy-Type Fail {
-#                      detail
-#      }
-
 }
 
 } # inner-tunnel server block