52 |
that the database is a plaintext file and the filter is written in |
that the database is a plaintext file and the filter is written in |
53 |
a shell programming language. Then it will look like |
a shell programming language. Then it will look like |
54 |
|
|
55 |
@example |
@smallexample |
56 |
#! /bin/sh |
#! /bin/sh |
57 |
|
|
58 |
DB=/var/db/userlist |
DB=/var/db/userlist |
65 |
echo "1" |
echo "1" |
66 |
fi |
fi |
67 |
done |
done |
68 |
@end example |
@end smallexample |
69 |
|
|
70 |
@node Declaring the Filter |
@node Declaring the Filter |
71 |
@subsection Declaring the Filter |
@subsection Declaring the Filter |
72 |
|
|
73 |
Here is how this filter is declared in the @file{raddb/config} file: |
Here is how this filter is declared in the @file{raddb/config} file: |
74 |
|
|
75 |
@example |
@smallexample |
76 |
filters @{ |
filters @{ |
77 |
filter check_clid @{ |
filter check_clid @{ |
78 |
exec-path "/usr/libexec/myfilter"; |
exec-path "/usr/libexec/myfilter"; |
84 |
@}; |
@}; |
85 |
@}; |
@}; |
86 |
@}; |
@}; |
87 |
@end example |
@end smallexample |
88 |
|
|
89 |
Let's analyze this declaration line by line: |
Let's analyze this declaration line by line: |
90 |
|
|
132 |
with @samp{|} in the value of @attr{Exec-Program-Wait} attribute, |
with @samp{|} in the value of @attr{Exec-Program-Wait} attribute, |
133 |
like this: |
like this: |
134 |
|
|
135 |
@example |
@smallexample |
136 |
DEFAULT Auth-Type = System, |
DEFAULT Auth-Type = System, |
137 |
Simultaneous-Use = 1 |
Simultaneous-Use = 1 |
138 |
Exec-Program-Wait = "|check_clid" |
Exec-Program-Wait = "|check_clid" |
139 |
@end example |
@end smallexample |
140 |
|
|
141 |
@node Adding Reply Attributes |
@node Adding Reply Attributes |
142 |
@subsection Adding Reply Attributes |
@subsection Adding Reply Attributes |
144 |
Apart from simply deciding whether to authenticate a user, the filter |
Apart from simply deciding whether to authenticate a user, the filter |
145 |
can also modify the reply pairs. |
can also modify the reply pairs. |
146 |
|
|
147 |
@example |
@smallexample |
148 |
#! /bin/sh |
#! /bin/sh |
149 |
|
|
150 |
DB=/var/db/userlist |
DB=/var/db/userlist |
158 |
\"You are not authorized to log in\"" |
\"You are not authorized to log in\"" |
159 |
fi |
fi |
160 |
done |
done |
161 |
@end example |
@end smallexample |
162 |
|
|
163 |
@node Accounting Filters |
@node Accounting Filters |
164 |
@subsection Accounting Filters |
@subsection Accounting Filters |
172 |
|
|
173 |
Now, our filter program will look as follows: |
Now, our filter program will look as follows: |
174 |
|
|
175 |
@example |
@smallexample |
176 |
#! /bin/sh |
#! /bin/sh |
177 |
|
|
178 |
AUTH_DB=/var/db/userlist |
AUTH_DB=/var/db/userlist |
192 |
acct) |
acct) |
193 |
echo "$CODE $NAME $CLID $DATE" >> $ACCT_DB |
echo "$CODE $NAME $CLID $DATE" >> $ACCT_DB |
194 |
done |
done |
195 |
@end example |
@end smallexample |
196 |
|
|
197 |
Its declaration in the @file{raddb/config} will also change: |
Its declaration in the @file{raddb/config} will also change: |
198 |
|
|
199 |
@example |
@smallexample |
200 |
filter check_clid @{ |
filter check_clid @{ |
201 |
exec-path "/usr/libexec/myfilter"; |
exec-path "/usr/libexec/myfilter"; |
202 |
error-log "myfilter.log"; |
error-log "myfilter.log"; |
211 |
wait-reply no; |
wait-reply no; |
212 |
@}; |
@}; |
213 |
@}; |
@}; |
214 |
@end example |
@end smallexample |
215 |
|
|
216 |
@noindent |
@noindent |
217 |
(The @code{input-format} lines are split for readability. Each of them |
(The @code{input-format} lines are split for readability. Each of them |
228 |
vertical bar character as a value of @attr{Acct-Ext-Program} in our |
vertical bar character as a value of @attr{Acct-Ext-Program} in our |
229 |
@file{raddb/hints} file. For example: |
@file{raddb/hints} file. For example: |
230 |
|
|
231 |
@example |
@smallexample |
232 |
DEFAULT NULL |
DEFAULT NULL |
233 |
Acct-Ext-Program = "|check_clid: |
Acct-Ext-Program = "|check_clid: |
234 |
@end example |
@end smallexample |
235 |
|
|
236 |
@comment *L1**************************************************************** |
@comment *L1**************************************************************** |
237 |
@node Rewrite |
@node Rewrite |
274 |
|
|
275 |
As an example, let's consider the following Rewrite function: |
As an example, let's consider the following Rewrite function: |
276 |
|
|
277 |
@example |
@smallexample |
278 |
@group |
@group |
279 |
string |
string |
280 |
foo(integer i) |
foo(integer i) |
287 |
return "the number is " + rc; |
return "the number is " + rc; |
288 |
@} |
@} |
289 |
@end group |
@end group |
290 |
@end example |
@end smallexample |
291 |
|
|
292 |
@noindent |
@noindent |
293 |
The function takes an integer argument and returns the string |
The function takes an integer argument and returns the string |
299 |
Another example is a function that adds a prefix to the @attr{User-Name} |
Another example is a function that adds a prefix to the @attr{User-Name} |
300 |
attribute: |
attribute: |
301 |
|
|
302 |
@example |
@smallexample |
303 |
@group |
@group |
304 |
integer |
integer |
305 |
px_add() |
px_add() |
308 |
return 0; |
return 0; |
309 |
@} |
@} |
310 |
@end group |
@end group |
311 |
@end example |
@end smallexample |
312 |
|
|
313 |
@noindent |
@noindent |
314 |
This function manipulates the contents of the incoming request; its |
This function manipulates the contents of the incoming request; its |
372 |
invoked for each packet from the @NAS{} @code{10.10.10.11}, the |
invoked for each packet from the @NAS{} @code{10.10.10.11}, the |
373 |
following huntgroup rule may be used: |
following huntgroup rule may be used: |
374 |
|
|
375 |
@example |
@smallexample |
376 |
@group |
@group |
377 |
DEFAULT NAS-IP-Address = 11.10.10.11 |
DEFAULT NAS-IP-Address = 11.10.10.11 |
378 |
Rewrite-Function = "fixup" |
Rewrite-Function = "fixup" |
379 |
@end group |
@end group |
380 |
@end example |
@end smallexample |
381 |
|
|
382 |
The @attr{Rewrite-Function} attribute may also be used in a @file{hints} |
The @attr{Rewrite-Function} attribute may also be used in a @file{hints} |
383 |
rule. In this case, it will invoke the function if the request matches |
rule. In this case, it will invoke the function if the request matches |
385 |
cause the function to be invoked for each request containing the user name |
cause the function to be invoked for each request containing the user name |
386 |
starting with @samp{P}: |
starting with @samp{P}: |
387 |
|
|
388 |
@example |
@smallexample |
389 |
@group |
@group |
390 |
DEFAULT Prefix = "P" |
DEFAULT Prefix = "P" |
391 |
Rewrite-Function = "fixup" |
Rewrite-Function = "fixup" |
392 |
@end group |
@end group |
393 |
@end example |
@end smallexample |
394 |
|
|
395 |
@noindent |
@noindent |
396 |
Note that in both cases the attribute can be used |
Note that in both cases the attribute can be used |
399 |
The packet rewrite function must be declared as having no arguments |
The packet rewrite function must be declared as having no arguments |
400 |
and returning an integer value: |
and returning an integer value: |
401 |
|
|
402 |
@example |
@smallexample |
403 |
@group |
@group |
404 |
integer fixup() |
integer fixup() |
405 |
@{ |
@{ |
406 |
@} |
@} |
407 |
@end group |
@end group |
408 |
@end example |
@end smallexample |
409 |
|
|
410 |
@noindent |
@noindent |
411 |
The actual return value from such a function is ignored, the integer |
The actual return value from such a function is ignored, the integer |
443 |
Such a port number can be used, for example, with the |
Such a port number can be used, for example, with the |
444 |
@attr{Add-Port-To-IP-Address} attribute (@pxref{Add-Port-To-IP-Address}): |
@attr{Add-Port-To-IP-Address} attribute (@pxref{Add-Port-To-IP-Address}): |
445 |
|
|
446 |
@example |
@smallexample |
447 |
@group |
@group |
448 |
/* |
/* |
449 |
* decode MAX port number |
* decode MAX port number |
481 |
return 0; |
return 0; |
482 |
@} |
@} |
483 |
@end group |
@end group |
484 |
@end example |
@end smallexample |
485 |
|
|
486 |
@subheading 2. Session @sc{id} parsing for Cisco AS 5300 series |
@subheading 2. Session @sc{id} parsing for Cisco AS 5300 series |
487 |
|
|
501 |
normal @attr{Acct-Session-Id}, and attempts to generate a |
normal @attr{Acct-Session-Id}, and attempts to generate a |
502 |
@attr{NAS-Port-Id} attribute. |
@attr{NAS-Port-Id} attribute. |
503 |
|
|
504 |
@example |
@smallexample |
505 |
@group |
@group |
506 |
/* |
/* |
507 |
* The port rewriting function for Cisco AS5300 used for |
* The port rewriting function for Cisco AS5300 used for |
574 |
return 0; |
return 0; |
575 |
@} |
@} |
576 |
@end group |
@end group |
577 |
@end example |
@end smallexample |
578 |
|
|
579 |
@subheading 3. User-name rewriting for @sc{nt} machines |
@subheading 3. User-name rewriting for @sc{nt} machines |
580 |
|
|
582 |
@samp{NT_DOMAIN\@var{username}}. The following function selects the |
@samp{NT_DOMAIN\@var{username}}. The following function selects the |
583 |
user-name part and stores it in the @attr{User-Name} attribute: |
user-name part and stores it in the @attr{User-Name} attribute: |
584 |
|
|
585 |
@example |
@smallexample |
586 |
@group |
@group |
587 |
integer |
integer |
588 |
login_nt(string uname) |
login_nt(string uname) |
602 |
return 0; |
return 0; |
603 |
@} |
@} |
604 |
@end group |
@end group |
605 |
@end example |
@end smallexample |
606 |
|
|
607 |
@comment *L2************************************************************** |
@comment *L2************************************************************** |
608 |
@node Login Verification Functions |
@node Login Verification Functions |
615 |
a @code{function} flag in the @file{raddb/nastypes} or @file{raddb/naslist} |
a @code{function} flag in the @file{raddb/nastypes} or @file{raddb/naslist} |
616 |
file (@pxref{nastypes file}). It must be defined as follows: |
file (@pxref{nastypes file}). It must be defined as follows: |
617 |
|
|
618 |
@example |
@smallexample |
619 |
@group |
@group |
620 |
integer check(string @var{str}, string @var{name}, integer @var{pid}, |
integer check(string @var{str}, string @var{name}, integer @var{pid}, |
621 |
string @var{sid}) |
string @var{sid}) |
622 |
@{ |
@{ |
623 |
@} |
@} |
624 |
@end group |
@end group |
625 |
@end example |
@end smallexample |
626 |
|
|
627 |
@noindent |
@noindent |
628 |
Its arguments are: |
Its arguments are: |
663 |
The function must return 1 if the three fields match the input |
The function must return 1 if the three fields match the input |
664 |
user name and port and session @sc{id}s: |
user name and port and session @sc{id}s: |
665 |
|
|
666 |
@example |
@smallexample |
667 |
integer |
integer |
668 |
check_unix(string str, string name, integer pid, string sid) |
check_unix(string str, string name, integer pid, string sid) |
669 |
@{ |
@{ |
671 |
&& field(str, 3) == pid |
&& field(str, 3) == pid |
672 |
&& field(str, 7) == sid; |
&& field(str, 7) == sid; |
673 |
@} |
@} |
674 |
@end example |
@end smallexample |
675 |
|
|
676 |
@c @xref{UNIX Finger}. |
@c @xref{UNIX Finger}. |
677 |
|
|
680 |
query returning a user name. This function must return 1 if the entire input |
query returning a user name. This function must return 1 if the entire input |
681 |
line matches the user name: |
line matches the user name: |
682 |
|
|
683 |
@example |
@smallexample |
684 |
integer |
integer |
685 |
check_username(string str, string name, integer pid, string sid) |
check_username(string str, string name, integer pid, string sid) |
686 |
@{ |
@{ |
687 |
return str == name; |
return str == name; |
688 |
@} |
@} |
689 |
@end example |
@end smallexample |
690 |
|
|
691 |
@comment **L3*************************************************************** |
@comment **L3*************************************************************** |
692 |
@node Attribute Creation Functions |
@node Attribute Creation Functions |
699 |
value will be assigned to. To invoke the function, write its name |
value will be assigned to. To invoke the function, write its name |
700 |
in the @AVP{} of the @RHS{} in the @file{raddb/users} file, e.g.: |
in the @AVP{} of the @RHS{} in the @file{raddb/users} file, e.g.: |
701 |
|
|
702 |
@example |
@smallexample |
703 |
@group |
@group |
704 |
DEFAULT Auth-Type = SQL |
DEFAULT Auth-Type = SQL |
705 |
Service-Type = Framed-User, |
Service-Type = Framed-User, |
706 |
Framed-IP-Address = "=get_ip_addr(10.10.10.1)" |
Framed-IP-Address = "=get_ip_addr(10.10.10.1)" |
707 |
@end group |
@end group |
708 |
@end example |
@end smallexample |
709 |
|
|
710 |
@noindent |
@noindent |
711 |
The function @code{get_ip_addr} will be invoked after successful |
The function @code{get_ip_addr} will be invoked after successful |
713 |
argument. An example of a useful function that can be invoked this |
argument. An example of a useful function that can be invoked this |
714 |
way is |
way is |
715 |
|
|
716 |
@example |
@smallexample |
717 |
@group |
@group |
718 |
@exindex IP pools for MAX Ascend |
@exindex IP pools for MAX Ascend |
719 |
integer |
integer |
722 |
return base + %[NAS-Port-Id] - %[NAS-Port-Id]/16; |
return base + %[NAS-Port-Id] - %[NAS-Port-Id]/16; |
723 |
@} |
@} |
724 |
@end group |
@end group |
725 |
@end example |
@end smallexample |
726 |
|
|
727 |
@comment *L2**************************************************************** |
@comment *L2**************************************************************** |
728 |
@node Full Syntax Description |
@node Full Syntax Description |
808 |
@attr{Rewrite-Function} attribute. It is kept as an associative array, |
@attr{Rewrite-Function} attribute. It is kept as an associative array, |
809 |
whose entries can be accessed using the following syntax: |
whose entries can be accessed using the following syntax: |
810 |
|
|
811 |
@example |
@smallexample |
812 |
@samp{%[} @var{attribute-name} @samp{]} |
@samp{%[} @var{attribute-name} @samp{]} |
813 |
@samp{%[} @var{attribute-name} @samp{]} @samp{(} @var{n} @samp{)} |
@samp{%[} @var{attribute-name} @samp{]} @samp{(} @var{n} @samp{)} |
814 |
@end example |
@end smallexample |
815 |
|
|
816 |
@noindent |
@noindent |
817 |
The first form returns the value of the attribute @var{attribute-name}. |
The first form returns the value of the attribute @var{attribute-name}. |
821 |
The second form returns the value of the @var{n}th attribute of type |
The second form returns the value of the @var{n}th attribute of type |
822 |
@var{attribute-name}. The index @var{n} is counted from zero, so |
@var{attribute-name}. The index @var{n} is counted from zero, so |
823 |
|
|
824 |
@example |
@smallexample |
825 |
%[@var{attribute-name}](0) |
%[@var{attribute-name}](0) |
826 |
@end example |
@end smallexample |
827 |
|
|
828 |
@noindent |
@noindent |
829 |
is equivalent to |
is equivalent to |
830 |
|
|
831 |
@example |
@smallexample |
832 |
%[@var{attribute-name}] |
%[@var{attribute-name}] |
833 |
@end example |
@end smallexample |
834 |
|
|
835 |
@item Identifiers |
@item Identifiers |
836 |
Identifiers represent functions and variables. These are described in |
Identifiers represent functions and variables. These are described in |
838 |
@item Regexp group references |
@item Regexp group references |
839 |
A sequence of characters in the form |
A sequence of characters in the form |
840 |
|
|
841 |
@example |
@smallexample |
842 |
@samp{\@var{number}} |
@samp{\@var{number}} |
843 |
@end example |
@end smallexample |
844 |
|
|
845 |
@noindent |
@noindent |
846 |
|
|
848 |
obtained as a result of the last executed @samp{=~} command. |
obtained as a result of the last executed @samp{=~} command. |
849 |
The regexp group reference has always string data type. For example: |
The regexp group reference has always string data type. For example: |
850 |
|
|
851 |
@example |
@smallexample |
852 |
@group |
@group |
853 |
string |
string |
854 |
basename(string @var{arg}) |
basename(string @var{arg}) |
859 |
return arg; |
return arg; |
860 |
@} |
@} |
861 |
@end group |
@end group |
862 |
@end example |
@end smallexample |
863 |
|
|
864 |
This function strips from @var{arg} all leading components up to the |
This function strips from @var{arg} all leading components up to the |
865 |
last slash character, and all trailing components after the last dot |
last slash character, and all trailing components after the last dot |
894 |
|
|
895 |
A Rewrite function is declared as follows: |
A Rewrite function is declared as follows: |
896 |
|
|
897 |
@example |
@smallexample |
898 |
@var{type} @var{function-name} (@var{parameter-list}) |
@var{type} @var{function-name} (@var{parameter-list}) |
899 |
@end example |
@end smallexample |
900 |
|
|
901 |
@noindent |
@noindent |
902 |
where @var{type} specifies the return type of the function, |
where @var{type} specifies the return type of the function, |
904 |
@var{parameter-list} declares the formal parameters to the function. |
@var{parameter-list} declares the formal parameters to the function. |
905 |
It is a comma-separated list of declarations in the form |
It is a comma-separated list of declarations in the form |
906 |
|
|
907 |
@example |
@smallexample |
908 |
@var{type} @var{parm-name} |
@var{type} @var{parm-name} |
909 |
@end example |
@end smallexample |
910 |
|
|
911 |
@noindent |
@noindent |
912 |
@var{type} being the parameter type, and @var{parm-name} being its |
@var{type} being the parameter type, and @var{parm-name} being its |
920 |
(@samp{@{}) and before any executable statements. The declaration |
(@samp{@{}) and before any executable statements. The declaration |
921 |
syntax is |
syntax is |
922 |
|
|
923 |
@example |
@smallexample |
924 |
@var{type} @var{ident_list} ; |
@var{type} @var{ident_list} ; |
925 |
@end example |
@end smallexample |
926 |
|
|
927 |
@noindent |
@noindent |
928 |
Here @var{ident_list} is either a valid Rewrite identifier or a |
Here @var{ident_list} is either a valid Rewrite identifier or a |
956 |
@subheading Type coercion |
@subheading Type coercion |
957 |
The type coercion is like a type cast in C. Its syntax is |
The type coercion is like a type cast in C. Its syntax is |
958 |
|
|
959 |
@example |
@smallexample |
960 |
@samp{(} @var{type} @samp{)} @var{ident} |
@samp{(} @var{type} @samp{)} @var{ident} |
961 |
@end example |
@end smallexample |
962 |
|
|
963 |
@noindent |
@noindent |
964 |
The result of type coercion is as follows: |
The result of type coercion is as follows: |
989 |
@subheading Assignment |
@subheading Assignment |
990 |
An assignment is |
An assignment is |
991 |
|
|
992 |
@example |
@smallexample |
993 |
@var{ident} = @var{expression} ; |
@var{ident} = @var{expression} ; |
994 |
@end example |
@end smallexample |
995 |
|
|
996 |
@noindent |
@noindent |
997 |
The variable @var{ident} is assigned the value of @var{expression}. |
The variable @var{ident} is assigned the value of @var{expression}. |
999 |
@subheading Function calls |
@subheading Function calls |
1000 |
These take the form |
These take the form |
1001 |
|
|
1002 |
@example |
@smallexample |
1003 |
@var{ident} ( @var{arg-list} ) |
@var{ident} ( @var{arg-list} ) |
1004 |
@end example |
@end smallexample |
1005 |
|
|
1006 |
@noindent |
@noindent |
1007 |
where @var{ident} is the identifier representing the function, and |
where @var{ident} is the identifier representing the function, and |
1019 |
The @samp{delete} statement is used to delete an attribute or attributes |
The @samp{delete} statement is used to delete an attribute or attributes |
1020 |
from the incoming request. Its syntax is: |
from the incoming request. Its syntax is: |
1021 |
|
|
1022 |
@example |
@smallexample |
1023 |
delete @var{attribute-name}; |
delete @var{attribute-name}; |
1024 |
delete @var{attribute-name}(@var{n}); |
delete @var{attribute-name}(@var{n}); |
1025 |
@end example |
@end smallexample |
1026 |
|
|
1027 |
The first variant deletes @emph{all} the attributes of the given type. |
The first variant deletes @emph{all} the attributes of the given type. |
1028 |
The second variant deletes only the @var{n}th occurrence of the matching |
The second variant deletes only the @var{n}th occurrence of the matching |
1136 |
is extremely convenient for representation of such objects. A Radius @AVP{} |
is extremely convenient for representation of such objects. A Radius @AVP{} |
1137 |
is represented by a Scheme pair; e.g., |
is represented by a Scheme pair; e.g., |
1138 |
|
|
1139 |
@example |
@smallexample |
1140 |
Session-Timeout = 10 |
Session-Timeout = 10 |
1141 |
@end example |
@end smallexample |
1142 |
|
|
1143 |
@noindent |
@noindent |
1144 |
is represented in Guile as |
is represented in Guile as |
1145 |
|
|
1146 |
@lisp |
@smalllisp |
1147 |
(cons "Session-Timeout" 10) |
(cons "Session-Timeout" 10) |
1148 |
@end lisp |
@end smalllisp |
1149 |
|
|
1150 |
The @code{car} of the pair can contain either the attribute dictionary |
The @code{car} of the pair can contain either the attribute dictionary |
1151 |
name or the attribute number. Thus, the above pair may also be |
name or the attribute number. Thus, the above pair may also be |
1152 |
written in Scheme as |
written in Scheme as |
1153 |
|
|
1154 |
@lisp |
@smalllisp |
1155 |
(cons 27 10) |
(cons 27 10) |
1156 |
@end lisp |
@end smalllisp |
1157 |
|
|
1158 |
@noindent |
@noindent |
1159 |
(because @attr{Session-Timeout} corresponds to attribute number 27). |
(because @attr{Session-Timeout} corresponds to attribute number 27). |
1161 |
Lists of @AVP{}s are represented by Scheme lists. For example, |
Lists of @AVP{}s are represented by Scheme lists. For example, |
1162 |
the Radius pair list |
the Radius pair list |
1163 |
|
|
1164 |
@example |
@smallexample |
1165 |
@group |
@group |
1166 |
User-Name = "jsmith", |
User-Name = "jsmith", |
1167 |
User-Password = "guessme", |
User-Password = "guessme", |
1168 |
NAS-IP-Address = 10.10.10.1, |
NAS-IP-Address = 10.10.10.1, |
1169 |
NAS-Port-Id = 10 |
NAS-Port-Id = 10 |
1170 |
@end group |
@end group |
1171 |
@end example |
@end smallexample |
1172 |
|
|
1173 |
@noindent |
@noindent |
1174 |
is written in Scheme as |
is written in Scheme as |
1175 |
|
|
1176 |
@lisp |
@smalllisp |
1177 |
@group |
@group |
1178 |
(list |
(list |
1179 |
(cons "User-Name" "jsmith") |
(cons "User-Name" "jsmith") |
1181 |
(cons "NAS-IP-Address" "10.10.10.1") |
(cons "NAS-IP-Address" "10.10.10.1") |
1182 |
(cons "NAS-Port-Id" 10)) |
(cons "NAS-Port-Id" 10)) |
1183 |
@end group |
@end group |
1184 |
@end lisp |
@end smalllisp |
1185 |
|
|
1186 |
@comment **L2*************************************************************** |
@comment **L2*************************************************************** |
1187 |
@node Authentication with Scheme |
@node Authentication with Scheme |
1213 |
For a function to add something to the reply @AVP{}s, it |
For a function to add something to the reply @AVP{}s, it |
1214 |
should return a pair in the form |
should return a pair in the form |
1215 |
|
|
1216 |
@lisp |
@smalllisp |
1217 |
(cons @var{return-code} @var{list}) |
(cons @var{return-code} @var{list}) |
1218 |
@end lisp |
@end smalllisp |
1219 |
|
|
1220 |
@noindent |
@noindent |
1221 |
where @var{return-code} is a boolean value of the same meaning as |
where @var{return-code} is a boolean value of the same meaning as |
1224 |
deny the authentication, returning an appropriate message to the user: |
deny the authentication, returning an appropriate message to the user: |
1225 |
|
|
1226 |
@exindex Scheme authentication function |
@exindex Scheme authentication function |
1227 |
@lisp |
@smalllisp |
1228 |
@group |
@group |
1229 |
(define (decline-auth request-list check-list reply-list) |
(define (decline-auth request-list check-list reply-list) |
1230 |
(cons #f |
(cons #f |
1233 |
"\r\nSorry, you are not |
"\r\nSorry, you are not |
1234 |
allowed to log in\r\n")))) |
allowed to log in\r\n")))) |
1235 |
@end group |
@end group |
1236 |
@end lisp |
@end smalllisp |
1237 |
|
|
1238 |
As a more constructive example, let's consider a function that |
As a more constructive example, let's consider a function that |
1239 |
allows the authentication only if a user name is found in its |
allows the authentication only if a user name is found in its |
1240 |
internal database: |
internal database: |
1241 |
|
|
1242 |
@lisp |
@smalllisp |
1243 |
@group |
@group |
1244 |
(define staff-data |
(define staff-data |
1245 |
(list |
(list |
1275 |
#t |
#t |
1276 |
reply-list))) |
reply-list))) |
1277 |
@end group |
@end group |
1278 |
@end lisp |
@end smalllisp |
1279 |
|
|
1280 |
To trigger the invocation of the Scheme authentication function, assign |
To trigger the invocation of the Scheme authentication function, assign |
1281 |
its name to the @attr{Scheme-Procedure} attribute in the @RHS{} of a |
its name to the @attr{Scheme-Procedure} attribute in the @RHS{} of a |
1283 |
|
|
1284 |
@exindex Invoking Scheme authentication function |
@exindex Invoking Scheme authentication function |
1285 |
@exindex Scheme authentication function, invocation |
@exindex Scheme authentication function, invocation |
1286 |
@example |
@smallexample |
1287 |
@group |
@group |
1288 |
DEFAULT Auth-Type = SQL |
DEFAULT Auth-Type = SQL |
1289 |
Scheme-Procedure = "auth" |
Scheme-Procedure = "auth" |
1290 |
@end group |
@end group |
1291 |
@end example |
@end smallexample |
1292 |
|
|
1293 |
@comment **L2*************************************************************** |
@comment **L2*************************************************************** |
1294 |
@node Accounting with Scheme |
@node Accounting with Scheme |
1312 |
the contents of the incoming request to a file: |
the contents of the incoming request to a file: |
1313 |
|
|
1314 |
@exindex Scheme accounting function |
@exindex Scheme accounting function |
1315 |
@lisp |
@smalllisp |
1316 |
@group |
@group |
1317 |
(define radius-acct-file "/var/log/acct/radius") |
(define radius-acct-file "/var/log/acct/radius") |
1318 |
|
|
1328 |
(newline port))) |
(newline port))) |
1329 |
#t) |
#t) |
1330 |
@end group |
@end group |
1331 |
@end lisp |
@end smalllisp |
1332 |
|
|
1333 |
@comment **L2*************************************************************** |
@comment **L2*************************************************************** |
1334 |
@node Radius-Specific Functions |
@node Radius-Specific Functions |