Realm and proxy

RADIUS > Settings > Realms/Proxys

It is possible to use the imRAD as a proxy RADIUS server. This means that it can consult a remote RADIUS server to validate a user.
The RADIUS realm module splits a User-Name attribute into "user" and "realm" portions. If the realm is found, the modules sets the control:Proxy-To-Realm attribute to the realm name. The server will then proxy the packet to the given realm.
For example, If a User-Name attribute is received as test@domain.com, "user" is "test" and "realm" is "domain.com".

realms point to server pools, and server pools point to home servers. Multiple realms can point to one server pool. One server pool can point to multiple home servers. Each home server can appear in one or more pools.

Home Server Pool

You can define a pool of home servers that is used for fail-over and load-balancing.

• fail-over(default): The request is sent to the first live home server in the list. i.e. If the first home server is marked "dead", the second one is chosen, etc.
• client-balance: The home server is chosen by hashing the source IP address of the packet. If that home server is down, the next one in the list is used, just as with "fail-over".

Home Server

A Home server is another RADIUS server that gets sent proxied requests and you can define several home servers.

Item	Required	Description
Name	Yes	It is the name of home server to distinguish it from others. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
Type	Yes	Home servers can be sent Access-Request packets or Accounting-Request packets. auth(default): Handles Access-Request packets acct: Handles Accounting-Request packets auth+acct: andles Access-Request packets at "port", and Accounting-Request packets at "port + 1"
IP Address	Yes	Input a IPv4 address of the home server(e.g. a.b.c.d)
Shared Secret	Yes	The shared secret use to "encrypt" and "sign" packets between the NAS and RADIUS. The secret can be any ascii string, up to 64 characters in length. The multibyte or Non-ASCII characters(e.g, korean, japaneses) are not allowed.
Port	Yes	It is the port to which packets are sent. Usually 1812 for type "auth", and 1813 for type "acct". Older servers may use 1645 and 1646.
Protocol	Yes	It is The transport protocol and the default is "udp". It may also be "tcp", in which case TCP will be used to talk to this home server.
Home Server Pool	Yes	A home server must be joined to a home server pool. ALL home servers in a home server pool have to be of the same type. i.e. they all have to be "auth", or they all have to be "acct", or the all have to be "auth+acct".

Advanced

If the home server does not respond to a request within this time, the server marks the request as timed out. After "response_timeouts", the home server is marked as being "zombie", and "zombie_period" starts. The response window can be a number between 0.001 and 60.000 Values on the low end are discouraged, as they will likely not work due to limitations of operating system timers.
The default response window is large because responses may be slow, especially when proxying across the Internet. Useful range of values: 5 to 60.

If the "zombie_period" and "revive_interval" configurations are set smaller, than it is possible for up to 50% of authentications to fail. As a result, we recommend enabling status checks, and we do NOT recommend using "revive_interval". The "revive_interval" is used ONLY if the "status_check" entry below is "none". Otherwise, it will not be used, and should be deleted. Useful range of values: 10 to 3600.

The proxying server (i.e. this one) can do periodic status checks to see if a dead home server has come back alive. If set to "none", then the other configuration items listed below are not used, and the "revive_interval" time is used instead.
If set to "status-server", the Status-Server packets are sent. Many RADIUS servers support Status-Server. If a server does not support it, please contact the server vendor and request that they add it. With status-server if the home server is marked as a zombie and a status-server response is received, it will be immediately marked as live. This prevents spurious failovers in federations such as eduroam, where intermediary proxy servers may be functional but the servers of a home institution may not be,
If set to "request", then Access-Request, or Accounting-Request packets are sent, depending on the "type" entry above (auth/acct).

Realms

realm은 DEFAULT realm과 <my.company.com>와 같은 영역 이름 형태로 지정 할 수 있습니다.
DEFAULT realm은 reaml 포함된 모든 user-name은 지정된 홈 서버를 통해 인증을 처리한다는 의미입니다. 그렇지 않고 <my.company.com>와 같은 특정 realm에 홈 서버를 지정하면 <my.company.com>이 포함된 user-name은 지정된 홈 서버로 인증 요청을 전송합니다.

아래 예시는 다음과 같습니다.
kim@sales.basein.net과 같은 user-name은 hsp-2에 포함된 홈 서버에서 인증하며 park@tech.basein.net과 같은 user-name은 로컬 RADIUS를 통해 인증하고 나머지 realm이 포함된 user-name은 hsp-1에 포함된 홈 서버에서 인증을 처리합니다.
realm이 포함되지 않은 user-name(에, hong)은 로컬 RADIUS에서 인증 합니다.

realm 이름	홈 서버 풀
DEFAULT	hsp-1
sales.basein.net	hsp-2
tech.basein.net	LOCAL

realm 등록

항목	필수	설명
Realm 이름	예	Realm 이름을 지정하며 realm이 지정되지 않은 나머지 모든 realm은 DEFAULT라고 입력하세요.
홈 서버 풀	예	realm이 포함된 User-name에 대한 인증을 처리할 풀을 선택하세요. 로컬에서 처리하려면 LOCAL 이라고 입력하세요.
Realm 지정 NAS-ID	아니오	이 값이 선택되면 지정된 NAS-ID를 통해 요청된 인증 정보만 홈 서버에 전송합니다.
nostrip	아니오	User-name과 realm 영역을 분리해 홈 서버에 전송 할 것인지를 나타냅니다. 일반적으로 홈 서버에 User-Name을 전송 할 때는 원본 형태를 그대로 유지 합니다. 예) nostrip 로컬 radius에 수신된 User-Name 홈 서버에 수신된 User-Name 선택하지 않음 hong@sales.baseinet hong@sales.basinet 선택 함 hong@sales.baseinet hong
정규식	아니오	정규식 형태로 realm 이름을 지정 할 경우 선택하세요. 정규식은 realm이 여러 sub-domain으로 이뤄진 환경에서 사용 하면 하나의 realm으로 여러 sub-domain을 포함 할 수 있습니다. 만일 example.net와 같은 realm을 등록 후 정규식을 선택하면 ~(.*\.)*example\.net$와 같은 정규식으로 자동 전환되며 example.net의 모든 sub-domain에 대해서 처리 할 수 있습니다.

---