depot/ops/nixos/bvm-radius/raddb/sites-available/eduroam

operator_name = "as205479.net"

# The VLAN to assign eduroam visitors
eduroam_default_guest_vlan = "100"

# The VLAN to assign your students/staff
eduroam_default_local_vlan = "100"

server eduroam {
	listen {
		type = auth
		ipv6addr = *
		port = 1812
	}
	listen {
		type = auth
		ipv4addr = *
		port = 1812
	}

	authorize {
		# Log requests before we change them
		linelog_recv_request

		# split_username_nai is a policy in the default distribution to 
		# split a username into username and domain.  We reject user-name 
		# strings without domains, as they're not routable.
		split_username_nai
		if (noop || !&Stripped-User-Domain) {
			reject
		}

		# Request Chargeable-User-Identity.
		cui

		# Send the request to the NRO for your region.
		# The details of the FLRs (Federation Level RADIUS servers)
		# are in proxy.conf.
		# You can make this condition as complex as you like, to 
		# include additional subdomains just concatenate the conditions
		# with &&.
		if (&Stripped-User-Domain != "${operator_name}") {
			update {
				control:Load-Balance-Key := &Calling-Station-ID
				control:Proxy-To-Realm := 'eduroam_flr'
				
				# Operator name (RFC 5580) identifies the network the 
				# request originated from. It's not absolutely necessary
				# but it helps with debugging.
				request:Operator-Name := "1${operator_name}"
			}
			return
		}

		# If the EAP module returns 'ok' or 'updated', it means it has handled
		# the request and we don't need to call any other modules in this
		# section.
		eap {
			ok = return
			updated = return
		}
	}

	pre-proxy {
		cui
		attr_filter.pre-proxy
		linelog_send_proxy_request
	}

	post-proxy {
		attr_filter.post-proxy
		linelog_recv_proxy_response
	}

	authenticate {
		eap
	}

	post-auth {
		# To implement eduroam you must:
		# - Use wireless access points or a controller which supports 
                #   dynamic VLAN assignments.
		# - Have that feature enabled.
		# - Have the guest_vlan/local_vlan available to the controller,
                #   or to all your access points.
		# eduroam user traffic *MUST* be segregated, this is *NOT* optional.
		update reply {
			Tunnel-Type := VLAN
			Tunnel-Medium-Type := IEEE-802
		}
		if (&control:Proxy-To-Realm) {
			update reply {
				Tunnel-Private-Group-ID = ${eduroam_default_guest_vlan}
			}
		}
		else {
			update reply {
				Tunnel-Private-Group-ID = ${eduroam_default_local_vlan}
			}
		}

		# We're sending a response to one of OUR network devices for one of 
		# OUR users so provide it with the real user-identity.
		if (&session-state:Stripped-User-Name) {
			update reply {
				User-Name := "%{session-state:Stripped-User-Name}@%{Stripped-User-Domain}"
			}
		}

		linelog_send_accept

		Post-Auth-Type REJECT {
			attr_filter.access_reject
			linelog_send_reject
		}
	}
}