radiator-radsec_inbound_openroaming.conf

# radiator-radsec_inbound_openroaming.conf
# for inbound RadSec connections for OpenRoaming
# 
# Copyright by Radiator Software 2020-2024
# Created: 2022-02-16 kh@radiatorsoftware.com
# Modified: 2025-01-23 kh@radiatorsoftware.com

# Radiator directories
DbDir	/etc/radiator
LogDir	/var/log/radiator
LogFile	%L/radiator-%{GlobalVar:instance}.log

# more detailed logging
LogMicroseconds
LogTraceId
Trace 2

# return only minimal information with Status-Server
StatusServer minimal

# Proxy also unknown attributes
ProxyUnknownAttributes

# Needed only for Radiator <= v4.28, an example how to use custom dictionaries
#DictionaryFile /opt/radiator/radiator/dictionary,/etc/radiator/dictionary.wba

# Dictionary file
DictionaryFile /opt/radiator/radiator/dictionary

# No pidfile is needed when started as a systemd service
PidFile

# Make IPv6 and IPv4 listen sockets completely separate
# Bind only to IPv4 wildcard address
BindV6Only
BindAddress	0.0.0.0

# this instance does not listen any RADIUS ports
AuthPort
AcctPort

# authentication log to file
<AuthLog FILE>

	Identifier AUTHLOG-FILE
	
	Filename %L/authentication-%{GlobalVar:instance}.log

	Include %D/conf.d/authlog-formats.conf

	LogSuccess
	LogFailure
	LogIgnore

</AuthLog>

# accounting log to file
<AcctLog FILE>

	Identifier ACCTLOG-FILE

	Filename %L/accounting-%{GlobalVar:instance}.log

	Include %D/conf.d/acctlog-formats.conf

</AcctLog>

# Clients
# 
# All RadSec clients are identified and authenticated with ServerRADSEC.
# There are no separate RadSec clients, which need to be defined.

#
# Servers
#

# RadSec server configuration
<ServerRADSEC>

	Identifier SERVER-RADSEC
	
	Port 2083
	Secret radsec
	Protocol tcp

        # These TLS settings are left liberal for interoperability.
        # They can be hardened, but functionality and interoperability with other
        # implementations need to tested in practice.
        TLS_SecurityLevel 1
        TLS_Protocols TLSv1,TLSv1.1,TLSv1.2,TLSv1.3

	TLS_CertificateType PEM
	TLS_CAPath %D/certificates/%{GlobalVar:instance}/ca/
	TLS_CertificateChainFile %D/certificates/%{GlobalVar:instance}/server/CertificateChainFile.pem
	TLS_PrivateKeyFile %D/certificates/%{GlobalVar:instance}/server/PrivateKeyFile.pem
	TLS_RequireClientCert

        # Strip vendor specific RADIUS attributes from the request
        Include /etc/radiator/conf.d/strip-osc-attributes.conf

        # Add to RADIUS request a vendor specific attribute, which contains
        # instance name, radsec client indentifier and radsec client ip address
        #AddToRequestIfNotExist OSC-Client-Identifier=%{GlobalVar:instance}/%{Client:Identifier}/%c

	# Add to RADIUS request information about the Radiator instance receiving it
	AddToRequest	OSC-Client-Identifier=CLIENT-RADSEC-INBOUND-OPENROAMING,\
			OSC-Service-Identifier=%{GlobalVar:instance},\
			OSC-Customer-Identifier=%{Operator-Name}

</ServerRADSEC>


#
# AuthBy authentication backends
#
<AuthBy RADIUS>

	Identifier AUTHBY-RADIUS-PROXY
	Secret mysecret
	Asynchronous
	UseExtendedIds
	Retries 1
	RetryTimeout 3
	FailureBackoffTime 0
	Host 127.0.0.1
	AuthPort 1812
	AcctPort 1813

	# Do not reply back the following attributes to OpenRoaming
	StripFromReply Tunnel-Type,Tunnel-Medium-Type,Tunnel-Private-Group-ID,OSC-Client-Identifier,OSC-Customer-Identifier,OSC-Environment-Identifier,OSC-Forwarded-For,OSC-Provider-Identifier,OSC-Service-Identifier
 
	# Add the SUBID and WBAID in the RADIUS reply. SUBID is not 
	# required, but this should be adjusted to real WBAID.
	AddToReplyIfNotExist WBA-Identity-Provider=4SUBID.WBAID

</AuthBy>


# requests with realms are forwarded to local RADIUS proxy
<Handler Realm=/.+/>

	Identifier HANDLER-FORWARD-TO-RADIUS-PROXY

	AuthBy AUTHBY-RADIUS-PROXY
	
	AuthLog AUTHLOG-FILE
	AcctLog ACCTLOG-FILE

</Handler>


# Default handler rejects authentication, accepts accounting
<Handler>
        Identifier HANDLER-DEFAULT
        <AuthBy INTERNAL>
                Identifier HANDLER-DEFAULT
                AuthResult REJECT
                AcctResult ACCEPT
                RejectReason HANDLER-DEFAULT: No matching handler found.
        </AuthBy>
        RejectHasReason
        AuthLog AUTHLOG-FILE
        AcctLog ACCTLOG-FILE
</Handler>