website/doc: Improve usability of Radius attributes

[cheggerdev]

Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link? Please describe.
Please add examples how to define non-vendor specific attributes.
@BeryJu pointed out in 15702 this is possible.

Please add examples how to add attributes for dynamic VLAN assignment and the long Class attribute.
Please also mention this currently only works with successful requests.

Provide the URL or link to the exact page in the documentation to which you are referring.
https://docs.goauthentik.io/add-secure-apps/providers/radius/#radius-attributes

[cheggerdev]

I looked into FreeRadius how it creates the long Class attribute.
Based on this I created a draft for the long Class attribute in a Radius property mapping.

@BeryJu Were can we get the values for Packet_Src_Port, NAS_IP_Address and Calling_Station_ID ? Basically all values need to be extracted from the radius request packet.

import hashlib

md5_object = hashlib.md5()

class_value_prefix = "ai:"   # Global Prefix used in Freeradius
Packet_Src_Port = 30000
Packet_Src_IP_Address = format(ak_client_ip())  # Take IPv4 address if available or IPv6Address, otherwise
NAS_IP_Address = ''
Calling_Station_ID = ''
User_Name = request.user.name  # Should be the username from the radius inner tunnel request packet
Session_User_Name = request.context.get("prompt_data").get('pending_user')  # Should be the radius outer tunnel username

ClassAttr = f'{class_value_prefix}{Packet_Src_Port}{Packet_Src_IP_Address}{NAS_IP_Address}{Calling_Station_ID}{User_Name}{Session_User_Name}'

if isinstance(ClassAttr, str):
    ClassAttr.encode('utf-8')

md5_object.update(ClassAttr)
packet['Class'] = md5_object.hexdigest()

return packet

[cheggerdev]

With above draft I get 'Failed to evaluate property-mapping'. I have no idea what is wrong.

I also have a draft for dynamic VLAN assignment but there I also get 'Failed to evaluate property-mapping' error.

[cheggerdev]

I figured out the attribute assignment to the packet causes the error.

The radius outpost uses pyrad, so I read the docs:
https://pyradius-pyrad.readthedocs.io/en/latest/api/packet.html

I tried various ways to add an attribute:

packet['Class'] = value
packet.AddAttribute("Class", value)
packet.dict.attributes["Class"] = value

but all fail with "Failed to evaluate property-mapping" error.
Only one way works, namely specifying an vendor for non-vendor-attributes (which is definitely a bug):

define_attribute(
    vendor_code=9,
    vendor_name="Cisco",
    attribute_name="Class",
    attribute_code=25,
    attribute_type="string",
)

packet['Cisco-Class'] = value

or

packet['Cisco-Tunnel-Type'] = 6

By experiment I figured out: I can use define_attribute() only once per property mapping.
A second define_attribute also results in "Failed to evaluate property-mapping".
Dynamic VLAN assignment requires three attributes => three property mappings.

Because of the vendor-enforcement the client receives funny attributes:

Received Access-Accept Id 65 from 172.16.1.6:1812 to 172.16.1.9:54477 length 113
	h323-setup-time = "1ea2d5de897064aea81e8888bff84561"    <== Should be the "Class"-Attribute
	Cisco-DHCP-Subscriber-Id = "\000\000\000\006"           <== Should be "Tunnel-Medium-Type"-Attribute
	Attr-26.9.81 = 0x323030                                 <== Should be "Tunnel-Private-Group-Id"-Attribute
	Attr-26.9.64 = 0x0000000d                               <== Should be "Tunnel-Type"-Attribute
	Message-Authenticator = 0x254401bf415ee687a2be867724132b5a

[cheggerdev]

Result of my analysis: By looking into the code, reading documentation and making experiments,
only one statement can be added to https://docs.goauthentik.io/add-secure-apps/providers/radius/#radius-attributes :

For each attribute to add to the response one Radius property mapping is required.

Other things like dynamic VLAN assignments and the long Class (RFC 2865) attribute are not possible to do. Therefore, they cannot be documented. Why?

For dynamic VLAN assignments, the Authentik dictionary misses the RFC 2868 attributes.
define_attribute() does not allow to define those missing attributes because it requires a vendor.

For the Class Attribute, it is available in the Authentik dictionary. Yet, it is not possible to assign a (hash) value to it without error (see comment above).
While RFC 2865 does not specify how the value should be calculated for the long Class attribute, it is recommended to do it the same way as FreeRadius does. Then it can be used in combination with FreeRadius Accounting.
For this calculation, access to the attributes in the Access-Request-Packet is required which is not available.
The available packet is the Access-Accept-Packet.