Configuring rlm_rest module in FreeRadius

freeradius

using FreeRADIUS I need to authenticate RADIUS users against a web backend and have been attempting to use the rlm_rest module to do it. See here.

In my site configuration I have something like this:

authorize {
    rest
}

and in the authentication section I've tried things like these:

authenticate {
    Auth-Type REST {
        rest
    }
}

or

authenticate {
    rest
}

In either case I get the following error: (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject

On my web server, I am returning the 204 code as it seems like that should authenticate the user without additional processes. See here. The authorization seems to work fine, but that error is returned once the authentication section is reached.

What I need to know is the combination of "users" file entry and sites-available entries that I need to allow the rlm_rest module to complete the authentication portion of the request. Thanks,

Best Answer

Rest doesn't set the Auth-Type, you have to do it manually.

authorize {
    rest
    if (ok) {
        update control {
            Auth-Type := rest
        }
    }
}

authenticate {
    rest
}

Auth-Types are automatically created for modules listed in authenticate (you don't actually need the Auth-Type stanza).

You don't need to call rest in authorize if you don't need to, something like this would also work fine:

authorize {
    if (User-Password) {
        update control {
            Auth-Type := rest
        }
    }
}

Edit:

Note: Prior to version 3.0.4 the REST module used control:Cleartext-Password to get the user's password, so in order for the module to work you'd need to copy the value over from request:User-Password:

authorize {
    if (User-Password) {
        update control {
            Cleartext-Password := &User-Password
            Auth-Type := rest
        }
    }
}

Versions 3.0.4 and later look for request:User-Password instead, which should just work in most cases.

Related Topic