Skip to content

Commit 4eef035

Browse files
stgmsastgmsa
committed
quote identity types, adds validator
1 parent e9250a1 commit 4eef035

File tree

62 files changed

+2273
-13
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+2273
-13
lines changed

‎conf/radiusd/eap.conf.example

Lines changed: 61 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -857,6 +857,49 @@ eap [% key -%] {
857857
#
858858
tls = [% eap.$key.teap_config.tls %]
859859

860+
default_eap_type = mschapv2
861+
862+
863+
# Set the EAP type for user / machine authentication.
864+
#
865+
# If set, these values over-ride "default_eap_type"
866+
#
867+
# These values can be over-ridden at run time by setting
868+
#
869+
# &session-state:TEAP-Type-User = ...
870+
#
871+
# and
872+
# &session-state:TEAP-Type-Machine = ...
873+
#
874+
# The values for those attributes are the same as for EAP-Type.
875+
#
876+
# Note that if you try to use "EAP-Type := TEAP" in the
877+
# "inner-tunnel" virtual server, it will not work.
878+
879+
# PASSWORDS
880+
#
881+
# Some supplicants support password authentication inside of
882+
# TEAP. This can be configured automatically by setting
883+
#
884+
# identity_type = "user"
885+
#
886+
# and then not setting "default_eap_type" or
887+
# "user_eap_type". The TEAP module will then
888+
# automatically initiate password authentication.
889+
#
890+
# The user credentials are placed into the User-Name
891+
# and User-Password attributes inside of the
892+
# "inner-tunnel" virtual server. These attributes
893+
# are not sent in TEAP, but are created by the module
894+
# from the Basic-Password-Auth-Resp TLV which is in TEAP.
895+
#
896+
# Supported authentication methods inside of TEAP are
897+
# EAP-TLS, EAP-MSCHAPv2, and PAP.
898+
899+
user_eap_type = tls
900+
machine_eap_type = mschapv2
901+
902+
#
860903
# If 'cipher_list' is set here, it will over-ride the
861904
# 'cipher_list' configuration from the 'tls-common'
862905
# configuration. The EAP-TEAP module has it's own
@@ -871,11 +914,6 @@ eap [% key -%] {
871914
#
872915
#cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
873916

874-
#pac = no
875-
# PAC lifetime in seconds (default: seven days)
876-
#
877-
# pac_lifetime = 604800
878-
879917
# Authority ID of the server
880918
#
881919
# If you are running a cluster of RADIUS servers, you should make
@@ -885,7 +923,24 @@ eap [% key -%] {
885923
#
886924
authority_identity = [% eap.$key.teap_config.authority_identity %]
887925

888-
identity_types = [% eap.$key.teap_config.identity_types %]
926+
927+
#
928+
# Automatically go through the workflow of first machine, then user
929+
# authentication.
930+
#
931+
# allowed values: "machine,user"
932+
# "user,machine"
933+
# "user"
934+
# "machine"
935+
#
936+
# If this isn't set, then TEAP likely won't work.
937+
#
938+
# This configuration sets &session-state:FreeRADIUS-EAP-TEAP-TLV-Identity-Type with the
939+
# relevant values. The TEAP module then picks those values, in order, to authenticate the
940+
# chosen identity. You can set &session-state:FreeRADIUS-EAP-TEAP-TLV-Identity-Type
941+
# manually, but that is substantially more complicated.
942+
#
943+
identity_types = "[% eap.$key.teap_config.identity_types %]"
889944

890945
# PAC Opaque encryption key (must be exactly 32 bytes in size)
891946
#

‎html/pfappserver/root/src/views/Configuration/radius/teap/schema.js

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@ import yup from '@/utils/yup'
44

55
yup.addMethod(yup.string, 'radiusTeapIdNotExistsExcept', function (exceptId = '', message) {
66
return this.test({
7-
name: 'radiusTeapIdNotExistsExcept',
8-
message: message || i18n.t('Identifier exists.'),
9-
test: (value) => {
7+
name: 'radiusTeapIdNotExistsExcept', message: message || i18n.t('Identifier exists.'), test: (value) => {
108
if (!value || value.toLowerCase() === exceptId.toLowerCase()) return true
119
return store.dispatch('config/getRadiusTeaps').then(response => {
1210
return response.filter(teap => teap.id.toLowerCase() === value.toLowerCase()).length === 0
@@ -19,19 +17,19 @@ yup.addMethod(yup.string, 'radiusTeapIdNotExistsExcept', function (exceptId = ''
1917

2018
export default (props) => {
2119
const {
22-
id,
23-
isNew,
24-
isClone
20+
id, isNew, isClone
2521
} = props
2622

2723
return yup.object().shape({
2824
id: yup.string()
2925
.nullable()
3026
.required(i18n.t('Identifier required.'))
27+
.max(20)
28+
.isAlphaNumericHyphenUnderscoreDot()
3129
.radiusTeapIdNotExistsExcept((!isNew && !isClone) ? id : undefined, i18n.t('Identifier exists.')),
3230
authority_identity: yup.string().nullable().label(i18n.t('Authority Identity')),
3331
identity_types: yup.string().nullable().label(i18n.t('Identity Types')),
34-
pac_opaque_key: yup.string().nullable().label(i18n.t('Key')),
32+
pac_opaque_key: yup.string().nullable().min(32).max(32).isHash().label(i18n.t('Key')),
3533
tls: yup.string().nullable().label(i18n.t('TLS Profile'))
3634
})
3735
}

‎t/venom/test_suites/wired_dot1x_eap_teap/00_enable_node_cleanup_task.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Enable node_cleanup maintenance task and change the delete_window
2+
testcases:
3+
- name: get_login_token
4+
steps:
5+
- type: get_login_token
6+
7+
- name: enable_node_cleanup_task
8+
steps:
9+
- type: http
10+
method: PATCH
11+
url: '{{.pfserver_webadmin_url}}/api/v1/config/maintenance_task/node_cleanup'
12+
ignore_verify_ssl: true
13+
body: >-
14+
{
15+
"status": "enabled"
16+
}
17+
headers:
18+
"Authorization": "{{.get_login_token.result.token}}"
19+
"Content-Type": "application/json"
20+
assertions:
21+
- result.statuscode ShouldEqual 200
22+
23+
- name: change_delete_window
24+
steps:
25+
- type: http
26+
method: PATCH
27+
url: '{{.pfserver_webadmin_url}}/api/v1/config/maintenance_task/node_cleanup'
28+
ignore_verify_ssl: true
29+
body: >-
30+
{
31+
"delete_window": {
32+
"interval": "{{.node_cleanup.delete_window.interval}}",
33+
"unit": "{{.node_cleanup.delete_window.unit}}"
34+
}
35+
}
36+
headers:
37+
"Authorization": "{{.get_login_token.result.token}}"
38+
"Content-Type": "application/json"
39+
assertions:
40+
- result.statuscode ShouldEqual 200

‎t/venom/test_suites/wired_dot1x_eap_teap/02_restart_pfcron_service.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Restart pfcron service
2+
testcases:
3+
- name: restart_pfcron_service
4+
steps:
5+
- type: pf_api_service_restart_async
6+
service: 'pfcron'

‎t/venom/test_suites/wired_dot1x_eap_teap/06_join_domain.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Join domain
2+
vars:
3+
# temp, workaround for https://github.com/ovh/venom/issues/445
4+
# pf only accepts hostname with less than 14 characters
5+
random_server_name: "{{ randAlpha 13 }}"
6+
random_ad_domain_id: "{{ randAlpha 7 }}"
7+
random_machine_account_password: "{{ randAlpha 16 }}"
8+
testcases:
9+
- name: get_login_token
10+
steps:
11+
- type: get_login_token
12+
13+
- name: create_domain
14+
steps:
15+
- type: http
16+
method: POST
17+
url: '{{.pfserver_webadmin_url}}/api/v1/config/domains'
18+
ignore_verify_ssl: true
19+
body: >-
20+
{
21+
"ad_fqdn": "ad.example.lan",
22+
"ad_server": "{{.ad_mgmt_ip}}",
23+
"bind_dn": "{{.ad_domain_admin_user}}",
24+
"bind_pass": "{{.ad_domain_admin_password}}",
25+
"dns_name": "{{.ad_dns_domain}}",
26+
"dns_servers": "{{.ad_mgmt_ip}}",
27+
"id": "{{.random_ad_domain_id}}",
28+
"ntlm_cache": null,
29+
"ntlm_cache_expiry": 3600,
30+
"ntlm_cache_source": null,
31+
"ntlmv2_only": null,
32+
"ou": "Computers",
33+
"registration": null,
34+
"server_name": "{{.random_server_name}}",
35+
"status": "enabled",
36+
"sticky_dc": "*",
37+
"workgroup": "{{.ad_domain_upper}}",
38+
"machine_account_password": "{{.random_machine_account_password}}"
39+
}
40+
headers:
41+
"Authorization": "{{.get_login_token.result.token}}"
42+
"Content-Type": "application/json"
43+
assertions:
44+
- result.statuscode ShouldEqual 201
45+
46+
- name: start_ntlm_auth_api_service
47+
steps:
48+
- type: pf_api_service_start_async
49+
service: 'ntlm-auth-api'
50+
51+
- name: sleep_some_time
52+
steps:
53+
- type: exec
54+
script: sleep 10
55+
56+
- name: test_machine_account
57+
steps:
58+
- type: http
59+
method: POST
60+
url: '{{.pfserver_webadmin_url}}/api/v1/ntlm/test'
61+
ignore_verify_ssl: true
62+
body: >-
63+
{
64+
"id": "{{.random_ad_domain_id}}",
65+
"machine_account_password": "{{.random_machine_account_password}}"
66+
}
67+
headers:
68+
"Authorization": "{{.get_login_token.result.token}}"
69+
"Content-Type": "application/json"
70+
assertions:
71+
- result.statuscode ShouldEqual 200

‎t/venom/test_suites/wired_dot1x_eap_teap/07_create_realms.yml

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Create and configure REALMS
2+
testcases:
3+
- name: get_login_token
4+
steps:
5+
- type: get_login_token
6+
7+
- name: get_ad_domain_id
8+
steps:
9+
- type: http
10+
method: GET
11+
url: '{{.pfserver_webadmin_url}}/api/v1/config/domains'
12+
ignore_verify_ssl: true
13+
headers:
14+
"Authorization": "{{.get_login_token.result.token}}"
15+
"Content-Type": "application/json"
16+
assertions:
17+
- result.statuscode ShouldEqual 200
18+
vars:
19+
domain_id:
20+
from: result.bodyjson.items.items0.id
21+
22+
- name: create_realms
23+
steps:
24+
- type: http
25+
method: POST
26+
url: '{{.pfserver_webadmin_url}}/api/v1/config/realms'
27+
ignore_verify_ssl: true
28+
body: >-
29+
{
30+
"admin_strip_username": "enabled",
31+
"domain": "{{.get_ad_domain_id.domain_id}}",
32+
"eduroam_options": null,
33+
"eduroam_radius_acct": null,
34+
"eduroam_radius_acct_proxy_type": "load-balance",
35+
"eduroam_radius_auth": null,
36+
"eduroam_radius_auth_compute_in_pf": "enabled",
37+
"eduroam_radius_auth_proxy_type": "keyed-balance",
38+
"id": "{{.ad_domain_upper}}",
39+
"ldap_source": null,
40+
"options": null,
41+
"permit_custom_attributes": "disabled",
42+
"portal_strip_username": "enabled",
43+
"radius_acct": null,
44+
"radius_acct_proxy_type": "load-balance",
45+
"radius_auth": null,
46+
"radius_auth_compute_in_pf": "enabled",
47+
"radius_auth_proxy_type": "keyed-balance",
48+
"radius_strip_username": "enabled"
49+
}
50+
headers:
51+
"Authorization": "{{.get_login_token.result.token}}"
52+
"Content-Type": "application/json"
53+
assertions:
54+
- result.statuscode ShouldEqual 201
55+
56+
- type: http
57+
method: POST
58+
url: '{{.pfserver_webadmin_url}}/api/v1/config/realms'
59+
ignore_verify_ssl: true
60+
body: >-
61+
{
62+
"admin_strip_username": "enabled",
63+
"domain": "{{.get_ad_domain_id.domain_id}}",
64+
"eduroam_options": null,
65+
"eduroam_radius_acct": null,
66+
"eduroam_radius_acct_proxy_type": "load-balance",
67+
"eduroam_radius_auth": null,
68+
"eduroam_radius_auth_compute_in_pf": "enabled",
69+
"eduroam_radius_auth_proxy_type": "keyed-balance",
70+
"id": "{{.ad_dns_domain}}",
71+
"ldap_source": null,
72+
"options": null,
73+
"permit_custom_attributes": "disabled",
74+
"portal_strip_username": "enabled",
75+
"radius_acct": null,
76+
"radius_acct_proxy_type": "load-balance",
77+
"radius_auth": null,
78+
"radius_auth_compute_in_pf": "enabled",
79+
"radius_auth_proxy_type": "keyed-balance",
80+
"radius_strip_username": "enabled"
81+
}
82+
headers:
83+
"Authorization": "{{.get_login_token.result.token}}"
84+
"Content-Type": "application/json"
85+
assertions:
86+
- result.statuscode ShouldEqual 201
87+
88+
- name: modify_builtin_realms
89+
steps:
90+
- type: http
91+
method: PATCH
92+
url: '{{.pfserver_webadmin_url}}/api/v1/config/realm/DEFAULT'
93+
ignore_verify_ssl: true
94+
body: >-
95+
{
96+
"domain": "{{.get_ad_domain_id.domain_id}}"
97+
}
98+
headers:
99+
"Authorization": "{{.get_login_token.result.token}}"
100+
"Content-Type": "application/json"
101+
assertions:
102+
- result.statuscode ShouldEqual 200
103+
104+
- type: http
105+
method: PATCH
106+
url: '{{.pfserver_webadmin_url}}/api/v1/config/realm/NULL'
107+
ignore_verify_ssl: true
108+
body: >-
109+
{
110+
"domain": "{{.get_ad_domain_id.domain_id}}"
111+
}
112+
headers:
113+
"Authorization": "{{.get_login_token.result.token}}"
114+
"Content-Type": "application/json"
115+
assertions:
116+
- result.statuscode ShouldEqual 200

‎t/venom/test_suites/wired_dot1x_eap_teap/10_restart_radius_services.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
name: Restart RADIUS services
2+
testcases:
3+
- name: restart_radius_services
4+
steps:
5+
- type: pf_api_service_restart_async
6+
service: 'radiusd-auth'
7+
8+
- type: pf_api_service_restart_async
9+
service: 'pfacct'

0 commit comments

Comments
 (0)