Thanks Hugh - works fine :-)<div><br><div class="gmail_quote">On Thu, Apr 23, 2009 at 9:37 AM, Hugh Irvine <span dir="ltr"><<a href="mailto:hugh@open.com.au">hugh@open.com.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Hello Steve -<br>
<br>
You will need to do a "find" to get the correct Client object first. The Client as far as TACACS+ is concerned is the ServerTACACSPLUS clause itself.<br>
<br>
Here is an example that tests fine on my machine with Radiator 4.4.<br>
<br>
<br>
#<br>
# client.pl<br>
#<br>
<br>
sub<br>
{<br>
my $p = ${$_[0]};<br>
<br>
my $nasip = $p->get_attr('NAS-IP-Address');<br>
my $nas = Radius::Util::inet_pton($nasip);<br>
my $client = Radius::Client::findAddress($nas);<br>
my $identifier = $client->{Identifier};<br>
print "Identifier is $identifier\n";<br>
}<br>
<br>
<br>
This assumes of course that the NAS-IP-Address is present in the derived RADIUS request.<br>
<br>
See my other example hooks in "goodies/hooks.txt".<br>
<br>
regards<br><font color="#888888">
<br>
Hugh</font><div><div></div><div class="h5"><br>
<br>
<br>
On 23 Apr 2009, at 16:39, Steve Rogers wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Hugh,<br>
<br>
We have this in the PostAuthHook code - shown below. Also I've attached a debug output extract showing the Client Identifier being null. And the Client definition. If we do a data dumper of $p->{Client} we don't see the Identifier.<br>
<br>
Any further suggestions we could look at?<br>
<br>
<Client 192.168.X.X><br>
Identifier noncisco<br>
TACACSPLUSKey XXXXXX<br>
</Client><br>
<br>
sub<br>
{<br>
my $p = ${$_[0]};<br>
my $rp = ${$_[1]};<br>
my $result = ${$_[2]};<br>
<br>
my $authGrp;<br>
my $tacAttr = 'tacplusgrp';<br>
<br>
if (($result == $main::ACCEPT) && ($authGrp = $rp->get_attr($tacAttr)))<br>
{<br>
my $clientId = $p->{Client}->{Identifier};<br>
&main::log($main::LOG_DEBUG, "Client Identifier = $clientId"); <br>
$authGrp .= '-'.$clientId;<br>
$rp->change_attr($tacAttr, "$authGrp");<br>
&main::log($main::LOG_DEBUG, "TACACS group = $authGrp");<br>
}<br>
}<br>
<br>
<br>
Thu Apr 23 07:26:19 2009: DEBUG: Handling request with Handler ''<br>
Thu Apr 23 07:26:19 2009: DEBUG: Deleting session for sr, 192.168.0.99,<br>
Thu Apr 23 07:26:19 2009: DEBUG: Handling with Radius::AuthFILE:<br>
Thu Apr 23 07:26:19 2009: DEBUG: Reading users file /Radiator/users<br>
Thu Apr 23 07:26:19 2009: DEBUG: Radius::AuthFILE looks for match with sr [sr]<br>
Thu Apr 23 07:26:19 2009: DEBUG: Expiration date converted to: 1264723200<br>
Thu Apr 23 07:26:19 2009: DEBUG: Radius::AuthFILE ACCEPT: : sr [sr]<br>
Thu Apr 23 07:26:19 2009: DEBUG: AuthBy FILE result: ACCEPT,<br>
Thu Apr 23 07:26:19 2009: DEBUG: Client Identifier =<br>
Thu Apr 23 07:26:19 2009: DEBUG: TACACS group = TACACSAdmins-<br>
Thu Apr 23 07:26:19 2009: DEBUG: Access accepted for sr<br>
Thu Apr 23 07:26:19 2009: DEBUG: Packet dump:<br>
*** Reply to TACACSPLUS request:<br>
Code: Access-Accept<br>
Identifier: UNDEF<br>
Authentic: _<240><12><227><155><2><196>2<145><171><144>><194><20>y<227><br>
Attributes:<br>
tacplusgrp = TACACSAdmins-<br>
<br>
Thu Apr 23 07:26:19 2009: DEBUG: TacacsplusConnection result Access-Accept<br>
Thu Apr 23 07:26:19 2009: DEBUG: TacacsplusConnection Authentication REPLY 1, 0,<br>
,<br>
Thu Apr 23 07:26:19 2009: DEBUG: TacacsplusConnection request 192, 2, 1, 0, 2, 6<br>
3<br>
<br>
Cheers<br>
Steve<br>
<br>
<br>
On Thu, Apr 23, 2009 at 1:51 AM, Hugh Irvine <<a href="mailto:hugh@open.com.au" target="_blank">hugh@open.com.au</a>> wrote:<br>
<br>
Hi Steve -<br>
<br>
Try this:<br>
<br>
.....<br>
<br>
my $identifer = $p->{Client}->{Identifier};<br>
<br>
.....<br>
<br>
regards<br>
<br>
Hugh<br>
<br>
<br>
<br>
On 22 Apr 2009, at 22:14, Steve Rogers wrote:<br>
<br>
Hi,<br>
<br>
We are using Radiator 4.4 with patches and attempting to get the Client-Identifier and use this in a hook as part of a Handler, but it doesn't seem to be available. Doing a bit of debug, we see the following line from ServerTACACSPLUS.pm and we can retrieve the Client-Identifier at this point but appears that when the module creates the fake radius request and we look at the object passed to the PostAuthHook (${$_[0]} we cant seem to get this.<br>
<br>
$tp->{Client} = $self; # So you can use Client-Identifier check items<br>
<br>
Is this possible? Or is there a simple mechanism to use the originating Client-Identifier from the Client that the TACACS request came from?<br>
<br>
Appreciate any help or advise.<br>
<br>
Cheers<br>
Steve<br>
_______________________________________________<br>
radiator mailing list<br>
<a href="mailto:radiator@open.com.au" target="_blank">radiator@open.com.au</a><br>
<a href="http://www.open.com.au/mailman/listinfo/radiator" target="_blank">http://www.open.com.au/mailman/listinfo/radiator</a><br>
<br>
<br>
<br>
NB:<br>
<br>
Have you read the reference manual ("doc/ref.html")?<br>
Have you searched the mailing list archive (<a href="http://www.open.com.au/archives/radiator" target="_blank">www.open.com.au/archives/radiator</a>)?<br>
Have you had a quick look on Google (<a href="http://www.google.com" target="_blank">www.google.com</a>)?<br>
Have you included a copy of your configuration file (no secrets),<br>
together with a trace 4 debug showing what is happening?<br>
Have you checked the RadiusExpert wiki:<br>
<a href="http://www.open.com.au/wiki/index.php/Main_Page" target="_blank">http://www.open.com.au/wiki/index.php/Main_Page</a><br>
<br>
-- <br>
Radiator: the most portable, flexible and configurable RADIUS server<br>
anywhere. Available on *NIX, *BSD, Windows, MacOS X.<br>
Includes support for reliable RADIUS transport (RadSec),<br>
and DIAMETER translation agent.<br>
-<br>
Nets: internetwork inventory and management - graphical, extensible,<br>
flexible with hardware, software, platform and database independence.<br>
-<br>
CATool: Private Certificate Authority for Unix and Unix-like systems.<br>
<br>
<br>
<br>
</blockquote>
<br>
<br>
<br>
NB:<br>
<br>
Have you read the reference manual ("doc/ref.html")?<br>
Have you searched the mailing list archive (<a href="http://www.open.com.au/archives/radiator" target="_blank">www.open.com.au/archives/radiator</a>)?<br>
Have you had a quick look on Google (<a href="http://www.google.com" target="_blank">www.google.com</a>)?<br>
Have you included a copy of your configuration file (no secrets),<br>
together with a trace 4 debug showing what is happening?<br>
Have you checked the RadiusExpert wiki:<br>
<a href="http://www.open.com.au/wiki/index.php/Main_Page" target="_blank">http://www.open.com.au/wiki/index.php/Main_Page</a><br>
<br>
-- <br>
Radiator: the most portable, flexible and configurable RADIUS server<br>
anywhere. Available on *NIX, *BSD, Windows, MacOS X.<br>
Includes support for reliable RADIUS transport (RadSec),<br>
and DIAMETER translation agent.<br>
-<br>
Nets: internetwork inventory and management - graphical, extensible,<br>
flexible with hardware, software, platform and database independence.<br>
-<br>
CATool: Private Certificate Authority for Unix and Unix-like systems.<br>
<br>
<br>
</div></div></blockquote></div><br></div>