Sending VSAs from FreeRADIUS and OpenLDAP

Question

This may seem simple, however after much trawling through the documentation it, unfortunately, isn't clear so any help will be much appreciated.

In short I want to return a VSA in response to an auth request. The VSA is a juniper VSA for virtual router and shows as 26-1 for vendor ID 4874. In the LDAP config I have the following which is working for standard RADIUS attributes.

update {
        control:Password-With-Header    += 'userPassword'
        reply:Reply-Message             := 'radiusReplyMessage'
        reply:Framed-IP-Address         := 'radiusFramedIPAddress'
        reply:Framed-IP-Netmask         := 'radiusFramedIPNetmask'
        reply:Framed-MTU                := 'radiusFramedMTU'
        #reply:Vendor_Specific[1]       := 'radiusJuniperVirtualRouter'

        #  Where only a list is specified as the RADIUS attribute,
        #  the value of the LDAP attribute is parsed as a valuepair
        #  in the same format as the 'valuepair_attribute' (above).
        control:            += 'radiusControlAttribute'
        request:            += 'radiusRequestAttribute'
        reply:              += 'radiusReplyAttribute'
    }

This returns

[root@ldapm01 sites-available]# radtest -x -4 -P udp testaccount2 password 127.0.0.1 1 testing123
Sent Access-Request Id 193 from 0.0.0.0:46100 to 127.0.0.1:1812 length 82
        User-Name = "testaccount2"
        User-Password = "password"
        NAS-IP-Address = 10.0.0.17
        NAS-Port = 1
        Message-Authenticator = 0x00
        Cleartext-Password = "password"
Received Access-Accept Id 193 from 127.0.0.1:1812 to 0.0.0.0:0 length 38
        Framed-IP-Address = 10.0.0.2
        Framed-IP-Netmask = 255.255.255.255
        Framed-MTU = 1500

So FreeRADIUS and LDAP are working. What I need to resolve is

#reply:<Juniper VSA 1> := 'radiusJuniperVirtualRouter'

Note: The available dictionary for juniper only supports vendor ID 2636, so I'll have to create a new dictionary file.

davetayl · Answer 1 · 2021-07-16T00:31:10.537

Ok so I found the answer, it's fairly simple actually. It's a matter of finding the name of the attribute in the appropriate dictionary and using that as the reference. Dictionary names are unique and are normally the attribute name proceeded by the dictionary name. In my case I had to grep the dictionary directory (Centos 7, /usr/share/freeradius) for the enterprise ID I needed, in my case 4874 which is dictinary.erx (thank you vendor consolidation).

Here is the ldap config

update {
    control:Password-With-Header    += 'userPassword'
    reply:Reply-Message             := 'radiusReplyMessage'
    reply:Framed-IP-Address     := 'radiusFramedIPAddress'
    reply:Framed-IP-Netmask     := 'radiusFramedIPNetmask'
    reply:Framed-MTU                    := 'radiusFramedMTU'
    reply:ERX-Virtual-Router-Name   := 'radiusVRF'

    #  Where only a list is specified as the RADIUS attribute,
    #  the value of the LDAP attribute is parsed as a valuepair
    #  in the same format as the 'valuepair_attribute' (above).
}

Then I also had to create a matching LDAP schema entry to support the added value, in my case I just extended the FreeRADIUS schema by adding the following

olcAttributeTypes: {65}( 1.3.6.1.4.1.11344.4.1.2.1.67 NAME 'radiusVRF' DESC 'requestItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

And then added it to the end of the olcObjectClasses list

olcObjectClasses: {0}( 1.3.6.1.4.1.11344.4.3.2.1 NAME 'radiusprofile' DESC '' SUP top AUXILIARY MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radiusAuthType $
 radiusCallbackId $ radiusCallbackNumber $radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $
 radiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $radiusFramedProtocol $ radiusAttribute $
 radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $
 radiusLoginLATService $ radiusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ radiusReplicateToRealm $
 radiusServiceType $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDN $ radiusSimultaneousUse $ radiusTunnelAssignmentId $
 radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $
 dialupAccess $ radiusNASIpAddress $ radiusReplyMessage $ radiusControlAttribute $ radiusReplyAttribute $ radiusRequestAttribute $ radiusNasId $ radiusVRF ) )

Now it is giving me the following

radtest -x -4 -P udp testaccount1 password 127.0.0.1 1 testing123

Sent Access-Request Id 24 from 0.0.0.0:49135 to 127.0.0.1:1812 length 82
        User-Name = "testaccount1"
        User-Password = "password"
        NAS-IP-Address = 10.0.0.17
        NAS-Port = 1
        Message-Authenticator = 0x00
        Cleartext-Password = "password"
Received Access-Accept Id 24 from 127.0.0.1:1812 to 0.0.0.0:0 length 48
        Framed-IP-Address = 10.0.0.1
        Framed-IP-Netmask = 255.255.255.255
        Framed-MTU = 1500
        juniper-unisphere-Virtual-Router = "12"

Sending VSAs from FreeRADIUS and OpenLDAP

1 Answers1