Difference between revisions of "Realm and proxy"

Latest revision as of 14:39, 16 April 2021

RADIUS > Settings > Realms/Proxys

It is possible to use the imRAD as a proxy RADIUS server. This means that it can consult a remote RADIUS server to validate a user^[1].
The RADIUS realm module splits a User-Name attribute into "user" and "realm" portions. If the realm is found, the modules sets the control:Proxy-To-Realm attribute to the realm name. The server will then proxy the packet to the given realm.^[2]
For example, If a User-Name attribute is received as test@domain.com, "user" is "test" and "realm" is "domain.com".

Realms point to server pools, and server pools point to home servers. Multiple realms can point to one server pool. One server pool can point to multiple home servers. Each home server can appear in one or more pools.

Home Server Pool

You can define a pool of home servers that is used for fail-over and load-balancing.

fail-over(default): The request is sent to the first live home server in the list. i.e. If the first home server is marked "dead", the second one is chosen, etc.
client-balance: The home server is chosen by hashing the source IP address of the packet. If that home server is down, the next one in the list is used, just as with "fail-over".

Home Server

A Home server is another RADIUS server that gets sent proxied requests and you can define several home servers.

Item	Required	Description
Name	Yes	It is the name of home server to distinguish it from others. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
Type	Yes	Home servers can be sent Access-Request packets or Accounting-Request packets. auth(default): Handles Access-Request packets acct: Handles Accounting-Request packets auth+acct: andles Access-Request packets at "port", and Accounting-Request packets at "port + 1"
IP Address	Yes	Input a IPv4 address of the home server(e.g. a.b.c.d)
Shared Secret	Yes	The shared secret use to "encrypt" and "sign" packets between the NAS and RADIUS. The secret can be any ascii string, up to 64 characters in length. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
Port	Yes	It is the port to which packets are sent. Usually 1812 for type "auth", and 1813 for type "acct". Older servers may use 1645 and 1646.
Protocol	Yes	It is The transport protocol and the default is "udp". It may also be "tcp", in which case TCP will be used to talk to this home server.
Home Server Pool	Yes	A home server must be joined to a home server pool. ALL home servers in a home server pool have to be of the same type. i.e. they all have to be "auth", or they all have to be "acct", or the all have to be "auth+acct".^[3]

Advanced

If the home server does not respond to a request within this time, the server marks the request as timed out. After "response_timeouts", the home server is marked as being "zombie", and "zombie_period" starts. The response window can be a number between 0.001 and 60.000 Values on the low end are discouraged, as they will likely not work due to limitations of operating system timers.
The default response window is large because responses may be slow, especially when proxying across the Internet. Useful range of values: 5 to 60.

If the "zombie_period" and "revive_interval" configurations are set smaller, than it is possible for up to 50% of authentications to fail. As a result, we recommend enabling status checks, and we do NOT recommend using "revive_interval". The "revive_interval" is used ONLY if the "status_check" entry below is "none". Otherwise, it will not be used, and should be deleted. Useful range of values: 10 to 3600.

The proxying server (i.e. this one) can do periodic status checks to see if a dead home server has come back alive. If set to "none", then the other configuration items listed below are not used, and the "revive_interval" time is used instead.
If set to "status-server", the Status-Server packets are sent. Many RADIUS servers support Status-Server. If a server does not support it, please contact the server vendor and request that they add it. With status-server if the home server is marked as a zombie and a status-server response is received, it will be immediately marked as live. This prevents spurious failovers in federations such as eduroam, where intermediary proxy servers may be functional but the servers of a home institution may not be,
If set to "request", then Access-Request, or Accounting-Request packets are sent, depending on the "type" entry above (auth/acct).^[4]

Realms

The realm DEFAULT matches all realms. The realm NULL matches any requests WITHOUT a realm.
If you set the Home server pool to LOCAL, the request will be handled locally as usual, without sending it to a remote radius server.

The following examples show how the proxy works.
If a User-Name attribute contains "sales.example.com" realm, the request will be sent to a home server in the hsp-2 home server pool.
If a User-Name attribute contains "tech.example.com" realm, the request will be processed in the local.
If a User-Name attribute contains any others realms, the request will be processed in the local.
If a User-Name attribute does not contain realm, the request will be processed in the local.

realm	Home server Pool
DEFAULT	LOCAL
sales.example.com	hsp-2
tech.example.com	LOCAL

Edit realm

Item	Required	Description
Realm	Yes	It is the realm. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed. The realm can be "DEFAULT".
Home Server Pool	Yes	Choose on of the home server pools .
Realm specific NAS-ID	No	If you select a NAS-ID, a request only from the NAS-ID will be proxying.
nostrip	No	By default the realm is stripped from the username before sending it on to the remote radius server. By specifying the "nostrip" option the @realm suffix will not be stripped.^[5]
regex	No	Any regex match is performed in a case-insensitive fashion. If you input a realm as "example.net" and set the regex, the realm will be saving as "~(.\.)example\.net$". The more regex realms that are defined, the more time it takes to process them. You should define as few regex realms as possible in order to maximize server performance.

References

↑ https://wiki.freeradius.org/config/Proxy
↑ https://networkradius.com/doc/3.0.10/raddb/mods-available/realm.html
↑ For example, the hsp-1 setting is ok but others are not ok.

Home server pool Home server Home server type

hsp-1 (ok) hs-10 auth

hs-11 auth

hsp-2 (not ok) hs-20 auth

hs-21 acct

hsp-3 (not ok) hs-30 auth

hs-31 auth+acct
↑ https://github.com/enckse/freeradius/blob/master/proxy.conf
↑ https://wiki.freeradius.org/config/Proxy

[1] ttps://wiki.freeradius.org/config/Proxy

[2] ttps://networkradius.com/doc/3.0.10/raddb/mods-available/realm.html

[3] For example, the hsp-1 setting is ok but others are not ok.

Home server pool Home server Home server type

hsp-1 (ok) hs-10 auth

hs-11 auth

hsp-2 (not ok) hs-20 auth

hs-21 acct

hsp-3 (not ok) hs-30 auth

hs-31 auth+acct

[4] ttps://github.com/enckse/freeradius/blob/master/proxy.conf

[5] ttps://wiki.freeradius.org/config/Proxy

[1]

[2]

[3]

[4]

[5]

@@ Line 1: / Line 1: @@
-=== RADIUS > 설정 > Realms/Proxys ===
+=== RADIUS > Settings > Realms/Proxys ===
-<br>
+It is possible to use the imRAD as a proxy RADIUS server. This means that it can consult a remote RADIUS server to validate a user<ref>https://wiki.freeradius.org/config/Proxy</ref>.<br>
-[[Realm|Realm 및 Proxy]] 정의는 3가지로 구성됩니다.
+The RADIUS realm module splits a User-Name attribute into "user" and "realm" portions. If the realm is found, the modules sets the control:Proxy-To-Realm attribute to the realm name. The server will then proxy the packet to the given realm.<ref>https://networkradius.com/doc/3.0.10/raddb/mods-available/realm.html</ref><br>
+For example, If a User-Name attribute is received as test@domain.com, "user" is "test" and "realm" is "domain.com".
+Realms point to server pools, and server pools point to home servers.  Multiple realms can point to one server pool. One server pool can point to multiple home servers. Each home server can appear in one or more pools.
+==== Home Server Pool ====
+You can define a pool of home servers that is used for fail-over and load-balancing.
+* fail-over(default): The request is sent to the first live home server in the list. i.e. If the first home server is marked "dead", the second one is chosen, etc.
+* client-balance: The home server is chosen by hashing the source IP address of the packet. If that home server is down, the next one in the list is used, just as with "fail-over".
+==== Home Server ====
+A Home server is another RADIUS server that gets sent proxied requests and you can define several home servers.
 {| class="wikitable"
-| 홈 서버 풀 || 홈 서버의 그룹을 의미하며 하나의 홈 서버 풀에는 두 개 이상의 홈 서버를 포함 할 수 있습니다.<br>
+! Item !! Required !! Description
-만일 두 개의 홈 서버가 포함되어 있다면 로컬 RADIUS는 하나의 서버가 장애로 판단되면 또 다른 서버로 인증을 요청합니다.
+|-
+| style='width:150px' | Name || Yes || It is the name of home server to distinguish it from others. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
 |-
-| 홈 서버 || 인증을 처리할 외부 인증 서버 정보를 의미합니다. 홈 서버는 반드시 하나의 홈 서버 풀에 포함되어야 합니다.
+| Type || Yes ||
+Home servers can be sent Access-Request packets or Accounting-Request packets.
+* auth(default): Handles Access-Request packets
+* acct: Handles Accounting-Request packets
+* auth+acct: andles Access-Request packets at "port", and Accounting-Request packets at "port + 1"
 |-
-| Realm(렐름) || User-Name 영역을 지정하며 realm에 따라 특정 홈 서버에서 처리 할 것인지 아니면 로컬 RADIUS에서 처리 할 것인지를 정의합니다.
+|IP Address || Yes || Input a IPv4 address of the home server(e.g. a.b.c.d)
 |-
-|}
+| Shared Secret || Yes || The shared secret use to "encrypt" and "sign" packets between the NAS and RADIUS.
+The secret can be any ascii string, up to 64 characters in length.
-새로운 Proxy를 정의하는 단계는 다음과 같습니다.
+The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
-. 홈 서버 풀 생성
+|-
-. 홈 서버 생성
+| Port || Yes || It is the port to which packets are sent. Usually 1812 for type "auth", and  1813 for type "acct". Older servers may use 1645 and 1646.
-. Realm 생성
+|-
+| Protocol || Yes || It is The transport protocol and the default is "udp". It may also be "tcp", in which case TCP will be used to talk to this home server.
+|-
-==== 홈 서버 풀 ====
+| Home Server Pool || Yes || A home server must be joined to a home server pool. ALL home servers in a home server pool have to be of the same type.  i.e. they all have to be "auth", or they all have to be "acct", or the all have to be "auth+acct".<ref>For example, the hsp-1 setting is ok but others are not ok.
-홈 서버 풀 목록 하단의 "추가" 버튼을 클릭하여 입력 할 수 있습니다.
 {| class="wikitable"
-! 항목 || 설명
 |-
-| 이름 || 홈 서버 풀을 식별 하기 위한 이름으로 원하는 이름으로 지정하면 되나 영문/숫자만 허용됩니다.
+! Home server pool !! Home server !! Home server type
+|-
+| rowspan="2" | hsp-1 (ok) || hs-10 ||  auth
+|-
+| hs-11 || auth
+|-
+| rowspan="2" | hsp-2 (not ok) || hs-20 ||  auth
 |-
-| 유형 ||
+| hs-21 || acct
-* fail-over: 첫 번째 live 서버에 인증 요청을 시도하며 그 서버가 장애로 감시되면 두 번째 서버로 인증 요청을 전송합니다(default).
+|-
-* client-balance: fail-over와 유사하나 인증 요청 패킷의 원본 IP 주소를 기반으로 외부 인증 서버(홈 서버)를 선택합니다.<ref>
+| rowspan="2" | hsp-3 (not ok) || hs-30 ||  auth
-이 외에도 load-balance, client-port-balance, keyed-balance와 같은 유형이 존재하나 imRAD에서는 지원하지 않습니다.
+|-
+| hs-31 || auth+acct
+|-
+|}
 </ref>
 |-
 |}
+===== Advanced =====
+If the home server does not respond to a request within this time, the server marks the request as timed out. After
+"'''response_timeouts'''", the home server is marked as being "zombie", and "'''zombie_period'''" starts. The '''response window''' can be a number between 0.001 and 60.000 Values on the low end are discouraged, as they will likely not work due to limitations of operating system timers.<br>
+The default response window is large because responses may be slow, especially when proxying across the Internet. Useful range of values: 5 to 60.
+If the "zombie_period" and "'''revive_interval'''" configurations are set smaller, than it is possible for up to 50% of authentications to fail. As a result, we recommend enabling status checks, and we do NOT recommend using "revive_interval". The "revive_interval" is used ONLY if the "'''status_check'''" entry below is "none".  Otherwise, it will not be used, and should be deleted. Useful range of values: 10 to 3600.
-==== 홈 서버 ====
+The proxying server (i.e. this one) can do periodic status checks to see if a dead home server has come back alive. If set to "none", then the other configuration items listed below are not used, and the "revive_interval" time is used instead.<br>
-모든 정보는 필수 입니다.
+If set to "status-server", the Status-Server packets are sent. Many RADIUS servers support Status-Server.  If a server does not support it, please contact the server vendor and request that they add it. With status-server if the home server is marked as a zombie and a status-server response is received, it will be immediately marked as live.
+This prevents spurious failovers in federations such as eduroam, where intermediary proxy servers may be functional but the servers of a home institution may not be,<br>
+If set to "request", then Access-Request, or Accounting-Request packets are sent, depending on the "type" entry above (auth/acct).<ref>https://github.com/enckse/freeradius/blob/master/proxy.conf</ref>
+==== Realms ====
+The realm '''DEFAULT''' matches all realms. The realm NULL matches any requests WITHOUT a realm.<br>
+If you set the Home server pool to '''LOCAL''', the request will be handled locally as usual, without sending it to a remote radius server.
+The following examples show how the proxy works.<br>
+If a User-Name attribute contains "sales.example.com" realm, the request will be sent to a home server in the hsp-2 home server pool.<br>
+If a User-Name attribute contains "tech.example.com" realm, the request will be processed in the local.<br>
+If a User-Name attribute contains any others realms, the request will be processed in the local.<br>
+If a User-Name attribute does not contain realm, the request will be processed in the local.
 {| class="wikitable"
-! 항목 || 설명
 |-
-| 이름 || 홈 서버를 식별 하기 위한 이름으로 원하는 이름으로 지정하면 되나 영문/숫자만 허용됩니다.
+! realm !! Home server Pool
 |-
-| 유형 ||
+| DEFAULT || LOCAL
-* auth: 인증 요청만 전송합니다(default).
-* acct: Accounting만 전송합니다.
-* auth+acct: 인증 요청 및 Accouting을 전송합니다.
-일반적으로 auth 및 auth+acct를 사용하며 어떠한 것을 사용 할 지는 외부 인증 서버 담당자에게 문의하세요.
 |-
-| Proxy 서버 IP 주소 || 외부 인증 서버의 IP 주소를 입력하세요. a.b.c.d/bit와 같은 서브넷 형태는 지원하지 않습니다.
+| sales.example.com || hsp-2
 |-
-| 공유키 || 공유키(hared secret key)를 입력하세요.
+| tech.example.com || LOCAL
 |-
-| 포트 || 인증 요청 혹은 accounting을 전송 할 외부 서버의 포트를 지정합니다. 표준 포트는 유형이 auth인 경우 1812 이며 acct인 경우는 1813 입니다. auth+acct인 경우도 1812를 입력하세요.<br>
+|}
-오래된 인증 서버는 1645, 1646를 사용하기도 하나 자세한 정보는 부 인증 서버 담당자에게 문의하세요.
-|-
-| 프로코콜 || 대부분의 radius 인증 서버는 udp를 사용합니다.
-|-
-| 홈 서버 풀 ||
-이미 생성되어 있는 홈 서버 풀 중 하나를 선택하세요.
-<ref>
-하나의 홈 서버 풀에 포함되어 있는 모든 홈 서버의 유형은 동일해야 합니다. 즉, 홈 서버의 유형이 auth라면 또 다른 홈서버도 auth 유형으로 지정되어야 합니다.
+===== Edit realm =====
 {| class="wikitable"
 |-
-! 홈 서버 풀 !! 홈 서버 !! 홈 서버 유형
+! style='width:200px' | Item !! Required !! Description
 |-
-| rowspan="2" | hsp-1<br>(정상) || hs-10 ||  auth
+| Realm || Yes ||
+It is the realm. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
+The realm can be "DEFAULT".
 |-
-| hsp-11 || auth
+| Home Server Pool || Yes || Choose on of the home server pools .
 |-
-| rowspan="2" | hsp-2<br>(잘못된 설정) || hs-20 ||  auth
+| Realm specific NAS-ID || No || If you select a NAS-ID, a request only from the NAS-ID will be proxying.
 |-
-| hsp-21 || acct
+| nostrip || No || By default the realm is stripped from the username before sending it on to the remote radius server. By specifying the "nostrip" option the @realm suffix will not be stripped.<ref>https://wiki.freeradius.org/config/Proxy</ref>
 |-
-| rowspan="2" | hsp-3<br>(잘못된 설정) || hs-30 ||  auth
+| regex || No || Any regex match is performed in a case-insensitive fashion. If you input a realm as "example.net" and set the regex, the realm will be saving as "~(.*\.)*example\.net$".
-|-
+<br>
-| hsp-31 || auth+acct
+The more regex realms that are defined, the more time it takes to process them. You should define as few regex realms as possible in order to maximize server performance.
-|-
-|}
-</ref>
 |-
 |}
+=== References ===

Home server pool	Home server	Home server type
hsp-1 (ok)	hs-10	auth
hsp-1 (ok)	hs-11	auth
hsp-2 (not ok)	hs-20	auth
hsp-2 (not ok)	hs-21	acct
hsp-3 (not ok)	hs-30	auth
hsp-3 (not ok)	hs-31	auth+acct