Re: cascading Radius-Servers
Igor V. Semenyuk (iga@sovam.com)
Tue, 17 Dec 1996 03:37:56 +0300 (MSK)
>
> According to Ulf Schmidt:
> >
> > I have to contact two radius-servers. In case the login is not found
> > on the first one, I want a second one to be checked, no matter
> > what result the first server returned (unless the first one is
> > successful, of course).
> >
> > This cannot be done by entering an alternative server, since this one
> > is only checked if the first doesn't respond at all.
> >
> > I'm running Merit Radius 2.4.21. Is is possible to cascade the
> > servers so one server asks another one in addition to it's own
> > configuration? Hope I made this clear...
>
> This isn't possible with the Merit server and it probably isn't
> even legal according to the RFC -- I know that the PortMaster
> doesn't work this way...
>
> Regards,
>
> web...
>
Why not? One can add an AATV which will call (or do inline) Unix-PW
AATV, and if negative, call (or do inline) [remote] RADIUS AATV. Both are
implemented in 2.4.21.
One thing I really miss in Merit's radius is accounting proxying/relaying.
That is if I have a realm being authenticated on a remote server I also
want accounting for users in this realm to passed to the same remote
server or (am I asking too much?) to an alternate remote server.
I can see some hooks for this in the sources but they look incomplete to me.
What about that?
--
Igor V. Semenyuk Internet: iga@sovam.com
SOVAM Teleport Phone: +7 095 258 4170
Moscow, Russia Fax: +7 095 258 4133