I am working on an integration between FreeRADIUS 3.0.15 and an API server in NodeJS, which will handle accounting, authorization and authentication. This is all documented (for instance, this repo is a very valuable starting point) and relatively straightforward.
However, I also want to use the Dynamic Clients module, and let my API server decide whether a client is allowed or not. I couldn't find any documentation on this, except for this thread on the FreeRADIUS mailing list, which contains a working example on how to let a remote API authorize a client:
# /sites-available/dynamic-clients
server dynamic_clients {
authorize {
if ("%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}") {
update control {
&FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
&FreeRADIUS-Client-Shortname = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'&return=shortname}"
&FreeRADIUS-Client-Secret = "%{rest: https://url?ipaddress='%{Packet-Src-IP-Address}'}&return=secret"
}
}
ok
}
}
This works, although there are a couple of issues:
- Is it possible to call the server only once to get different attributes? In the above cited thread, one of the authors suggests to "format your responses correctly" and links to some API docs, but I honestly could not understand what it means.
Is it possible to send a POST request with a JSON payload? This is not crucial but it's easily doable when configuring the rest module, just by declaring a section:
# /mods-available/rest rest { # ... other sections authenticate { uri = "${..connect_uri}/radius/authenticate" method = 'post' body = 'json' data = '{ "username": "%{User-Name}", "password": "%{User-Password}" }' } ... other sections }
In this respect, what I miss is the syntax for the REST expansion, I looked around but couldn't find anything (the only documentation page I found says there is no available expansion).