xenial (5) rlm_policy.5.gz

NAME

       rlm_policy - FreeRADIUS Module

DESCRIPTION

       The rlm_policy module implements a simple "policy" language.

       The  policy language implemented by this module is simple, and specific to RADIUS.  It does not implement
       variables, arrays, loops, goto's, or any other feature of a real language.  If those features are  needed
       for your system, we suggest using rlm_perl.

       What  the policy module implements is a simple way to look for attributes in the request packet (or other
       places), and to add attributes to the reply packet (or other places) based on those decisions.  Where the
       module shines is that it is significantly more flexible than the old-style users file.

       The module has one configuration item:

       filename
              The file where the policy is stored.

POLICY LANGUAGE

   Named policies
       The  policy  is  composed  of  a  series of named policies.  The following example defines a policy named
       "foo".

            policy foo {
                 ...
            }

       Policy names MAY NOT be the same as attributes in the dictionary.  Defining a policy with the  same  name
       as a dictionary attribute will cause an error message to be printed, and the policy will not be loaded.

       When  the  policy  module is listed in a module section like "authorize", the module calls a policy named
       "authorize".  The "post-auth", etc. sections behave the same.  These names cannot be changed.

            include "policy.txt"

       The filename must be in a double-quoted string, and is assumed to be relative  to  the  location  of  the
       current  file.   If  the filename ends with a '/', then it is assumed to be a directory, and all files in
       that directory will be read.

            include "dir/"

       All file in "dir/" will be read and included into the policy definition.  Any dot files (".", "..", etc.)
       will not be included, however.

   Including multiple files
       The  main file referred to from the radiusd.conf may include one or more other files, as in the following
       example.

   Referencing a named policy
       The following example references a named policy      foo() While the brackets are required, no  arguments
       may be passed.

   Conditions
       "if" statements are supported.

            if (expression) {
                 ...
            }

       and "else"

            if (expression) {
                 ...
            } else {
                 ...
            }

       also, "else if"

            if (expression) {
                 ...
            } else if (expression) {
                 ...
            }

   Expressions within if statements
       Always have to have brackets around them.  Sorry.

       The following kinds of expressions may be used, with their meanings.

       (attribute-reference)
              TRUE  if  the  referenced  attribute  exists, FALSE otherwise.  See below for details on attribute
              references.

       (!(expression))
              FALSE if the expression returned TRUE, and TRUE if the nested expression returned FALSE.

       (attribute-reference == value)
              Compares the attribute to the value.  The operators here can be "==", "!=", "=~", "!~", "<", "<=",
              ">", and ">=".

       (string1 == string2)
              A  special  case of the above.  The "string1" is dynamically expanded at run time, while "string2"
              is not.  The operators here can be "==", "!=", "=~",and "!~".  Of these, the most useful is  "=~',
              which  lets  you  do  things like ("%{ldap:query...}" =~ "foo=(.*) ").  The results of the regular
              expression match are put into %{1}, and can be  used  later.   See  "doc/variables.txt"  for  more
              information.

       ((expression1) || (expression2))
              Short-circuit "or".  If expression1 is TRUE, expression2 is not evaluated.

       ((expression1) && (expression2))
              Short-circuit "and".  If expression1 is FALSE, expression2 is not evaluated.

       Limitations.
              The && and || operators have equal precedence. You can't call a function as a expression.

   Attribute references
       Attribute references are:

       Attribute-Name
              Refers  to an attribute of that name in the Access-Request or Accounting-Request packet.  May also
              refer to "server-side" attributes, which are not documented anywhere.

       request:Attribute-Name
              An alternate way of referencing an attribute in the request packet.

       reply:Attribute-Name
              An attribute in the reply packet

       proxy-request:Attribute-Name
              An attribute in the Access-Request or Accounting-Request packet which will be proxied to the  home
              server.

       proxy-reply:Attribute-Name
              An attribute in the Access-Accept or other packet which was received from a home server.

       control:Attribute-Name
              An  attribute  in  the  per-request  configuration  and control attributes.  Also known as "check"
              attributes (doc/variables.txt).

   Adding attributes to reply packet (or other location)
            reply .= {
                 attribute-name = value
                 ...
                 attribute-name = value
            }

       The first name can be "request", "reply", "control", "proxy-request", or "proxy-reply".

       The operator can be

        .= - appends attributes to end of the list

        := - replaces existing list with the attributes in the list (bad idea)

        = - use operators from "attribute = value" to decide what to do. (see "users")

       The block must contain only attributes and values.  Nothing else is permitted.

SECTIONS

       authorize post-auth pre-proxy post-proxy

FILES

       /etc/raddb/radiusd.conf

SEE ALSO

       radiusd(8), users(5), radiusd.conf(5)

AUTHOR

       Alan DeKok <aland@ox.org>

                                                 7 December 2004                                   rlm_policy(5)