eduroam setup

#############
### Wireless controller config ###
#client uni_wlc_ipv4 {
#        ipaddr = 192.1xx.0.18
#        secret = sharedSecretGoesHere
#        require_message_authenticator = no
#        nas_type = other
#    Operator-Name = 1uni.ac.ma
#    add_cui = yes
#}
#client uni_wlc_ipv6 {
#        ipaddr = 2001:db8::18
#        secret = sharedSecretGoesHere
#        require_message_authenticator = no
#        nas_type = other
#        Operator-Name = 1uni.ac.ma
#        add_cui = yes
#}

### IPv6 localhost server for tests ###
client localhost_ipv6 {
        ipv6addr        = ::1
        secret          = testing123
        require_message_authenticator = no
        nas_type = other
        limit {
                max_connections = 16
                lifetime = 0
                idle_timeout = 30
        }
}

### Morocco eTLR servers ###
client eduroam-morocco-flr1-ipv4 {
        ipaddr = 196.200.131.17
        secret = placeSharedSecr3there
        nastype = 'eduroam_flr'
}

client eduroam-morocco-flr1-ipv6 {
       ipaddr = 2001:4310:f6:d::17
       secret = placeSharedSecr3tHere
       nastype = 'eduroam_flr'
}

client eduroam-morocco-flr2-ipv4 {
        ipaddr = 196.200.160.18
        secret = placeSharedSecretHere
        nastype = 'eduroam_flr'
}

client eduroam-morocco-flr2-ipv6 {
       ipaddr = 2001:4310:f1::18
       secret = placeSharedSecretHere
       nastype = 'eduroam_flr'
}
#############

linelog cui_log {
#    filename = syslog
    filename = ${logdir}/radius.log
    format = ""
    reference = "auth_log.%{%{reply:Packet-Type}:-format}"
    auth_log {
        Access-Accept = "%t : eduroam-auth#ORG=%{request:Realm}#USER=%{User-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=OK#"
        Access-Reject = "%t : eduroam-auth#ORG=%{request:Realm}#USER=%{User-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown}#MSG=%{%{reply:Reply-Message}:-No Failure Reason}#RESULT=FAIL#"
    }
}

cui_hash_key = "changeme"   # --> replace with a random string
                            # if you use a secondary or backup FreeRADIUS server, use the same cui_hash_key
                            # this allows you to keep the same CUI log even if the FreeRADIUS server change
cui_require_operator_name = "yes"

DEFAULT
...
        User-Name =* ANY,
        Chargeable-User-Identity =* ANY,
...

Edit policy.d/filter, add a filter function 'cui_filter'. Simple example :

# Filter the Chargeable-User-Identity attribute
cui_filter {
  if (&reply:Chargeable-User-Identity =~ /REPLACE-WITH-CUI-TO-MATCH/) {
                        update request {
                                &Module-Failure-Message += "Rejected: CUI matching '%{reply:Chargeable-User-Identity}'"
                        }
                        reject
       }
}

#############
proxy server {
        default_fallback = no
}

home_server localhost {
        type = auth
        ipaddr = ::1
        port = 1812
        secret = testing123
        response_window = 20
        zombie_period = 40
        revive_interval = 120
        status_check = status-server
        check_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        max_outstanding = 65536
        coa {
                irt = 2
                mrt = 16
                mrc = 5
                mrd = 30
        }

        limit {
              max_connections = 16
              max_requests = 0
              lifetime = 0
              idle_timeout = 0
        }

}

# Please modify this with your university's domain
realm uni.ac.ma {
        type            = radius
        authhost        = LOCAL
        accthost        = LOCAL
}

# Please modify this with your university's domain
realm "~(.*\.)uni\.ac\.ma$" {
        type            = radius
        authhost        = LOCAL
        accthost        = LOCAL
}

realm LOCAL {
        type            = radius
        authhost        = LOCAL
        accthost        = LOCAL
}
realm NULL {
        type            = radius
        authhost        = LOCAL
        accthost        = LOCAL
}

### Morocco eTLR servers
home_server eduroam_morocco_flr1_ipv4 {
        type                    = auth+acct
        ipaddr                  = 196.200.131.17
        port                    = 1812
        secret                  = sharedSecretGoesHere
        response_window         = 20
        zombie_period           = 40
        status_check            = status-server
        revive_interval         = 60
        check_interval          = 30
        num_answers_to_alive    = 3
}

home_server eduroam_morocco_flr1_ipv6 {
        type                    = auth+acct
        ipaddr                  = 2001:4310:f6:d::17
        port                    = 1812
        secret                  = sharedSecretGoesHere
        response_window         = 20
        zombie_period           = 40
        status_check            = status-server
        revive_interval         = 60
        check_interval          = 30
        num_answers_to_alive    = 3
}

home_server eduroam_morocco_flr2_ipv4 {
        type                    = auth+acct
        ipaddr                  = 196.200.160.18
        port                    = 1812
        secret                  = sharedSecretGoesHere
        response_window         = 20
        zombie_period           = 40
        status_check            = status-server
        revive_interval         = 60
        check_interval          = 30
        num_answers_to_alive    = 3
}

home_server eduroam_morocco_flr2_ipv6 {
        type                    = auth+acct
        ipaddr                  = 2001:4310:f1::18
        port                    = 1812
        secret                  = sharedSecretGoesHere
        response_window         = 20
        zombie_period           = 40
        status_check            = status-server
        revive_interval         = 60
        check_interval          = 30
        num_answers_to_alive    = 3
}

home_server_pool eduroam_morocco_pool {
        type = keyed-balance
        home_server = eduroam_morocco_flr2_ipv4
        home_server = eduroam_morocco_flr1_ipv4
}

### Catch all non local users and route the requests to Morocco's eFLR servers
realm "~.+$" {
        auth_pool = eduroam_morocco_pool
        nostrip
}
#############

##############
# The domain users will add to their username to have their credentials
# routed to your institution.  You will also need to register this
# and your RADIUS server addresses with your NRO.
operator_name = "univ.ma"

# The VLAN to assign eduroam visitors
eduroam_default_guest_vlan = "17"

# The VLAN to assign your students/staff
eduroam_default_local_vlan = "14"

server eduroam {
    listen {
        type = auth
        ipaddr = *
        port = 0
            limit {
                    max_connections = 16
            lifetime = 0
            idle_timeout = 30
            }
    }
    listen {
                type = acct
        ipaddr = *
            port = 0
            limit {
        }
    }

    listen {
            type = auth
        ipv6addr = ::
        port = 0
            limit {
                    max_connections = 16
                    lifetime = 0
            idle_timeout = 30
        }
    }

    listen {
                type = acct
        ipv6addr = ::
        port = 0
            limit {
        }
    }

    authorize {
        update request {
                    Operator-Name := "1univ.ma"
                    # The "1" above is important, do not change.
                }
                cui
                preprocess
        filter_username
        auth_log
        suffix
        eap {
            ok = return
            updated = return
        }
        files
        #ldap
        pap
    }

    pre-proxy {
        attr_filter.pre-proxy
        #linelog_send_proxy_request
                cui
    }

    post-proxy {
        attr_filter.post-proxy
        #linelog_recv_proxy_response
    }

    authenticate {
            Auth-Type PAP {
                    pap
                    #ldap
            }
            Auth-Type CHAP {
                    chap
                    #ldap
            }
            Auth-Type MS-CHAP {
                    mschap
                    #ldap
            }
            #Auth-Type LDAP {
                    #ldap
            #}
        eap

    }

    post-auth {
                cui
                cui_log
        update reply {
            Tunnel-Type := VLAN
            Tunnel-Medium-Type := IEEE-802
        }
        if (&control:Proxy-To-Realm) {
            update reply {
                Tunnel-Private-Group-ID = ${eduroam_default_guest_vlan}
            }
        }
        else {
            update reply {
                Tunnel-Private-Group-ID = ${eduroam_default_local_vlan}
            }
        }

        # We're sending a response to one of OUR network devices for one of
        # OUR users so provide it with the real user-identity.
        if (&session-state:Stripped-User-Name) {
            update reply {
                User-Name := "%{session-state:Stripped-User-Name}@%{Stripped-User-Domain}"
            }
        }

        #linelog_send_accept

        Post-Auth-Type REJECT {
            attr_filter.access_reject
            #linelog_send_reject
        }
    }
}
##############

###############
server inner-tunnel {
    listen {
        type = auth
        ipaddr = 127.0.0.1
        port = 18120 # Used for testing only.  Requests proxied internally.
    }

    authorize {
    #
        #  The chap module will set 'Auth-Type := CHAP' if we are
        #  handling a CHAP request and Auth-Type has not already been set
        chap

        #
        #  If the users are logging in with an MS-CHAP-Challenge
        #  attribute for authentication, the mschap module will find
        #  the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
        #  to the request, which will cause the server to then use
        #  the mschap module for authentication.
        mschap

        #
        #  Pull crypt'd passwords from /etc/passwd or /etc/shadow,
        #  using the system API's to get the password.  If you want
        #  to read /etc/passwd or /etc/shadow directly, see the
        #  passwd module, above.
        #
#       unix

        #
        #  Look for IPASS style 'realm/', and if not found, look for
        #  '@realm', and decide whether or not to proxy, based on
        #  that.
#       IPASS

        #
        #  If you are using multiple kinds of realms, you probably
        #  want to set "ignore_null = yes" for all of them.
        #  Otherwise, when the first style of realm doesn't match,
        #  the other styles won't be checked.
        #
        #  Note that proxying the inner tunnel authentication means
        #  that the user MAY use one identity in the outer session
        #  (e.g. "anonymous", and a different one here
        #  (e.g. "user@example.com").  The inner session will then be
        #  proxied elsewhere for authentication.  If you are not
        #  careful, this means that the user can cause you to forward
        #  the authentication to another RADIUS server, and have the
        #  accounting logs *not* sent to the other server.  This makes
        #  it difficult to bill people for their network activity.
        #
        suffix
#       ntdomain

        #
        #  The "suffix" module takes care of stripping the domain
        #  (e.g. "@example.com") from the User-Name attribute, and the
        #  next few lines ensure that the request is not proxied.
        #
        #  If you want the inner tunnel request to be proxied, delete
        #  the next few lines.
        #
update control {
               Proxy-To-Realm := LOCAL
        }

        #
        #  This module takes care of EAP-MSCHAPv2 authentication.
        #
        #  It also sets the EAP-Type attribute in the request
        #  attribute list to the EAP type from the packet.
        #
        #  The example below uses module failover to avoid querying all
        #  of the following modules if the EAP module returns "ok".
        #  Therefore, your LDAP and/or SQL servers will not be queried
        #  for the many packets that go back and forth to set up TTLS
        #  or PEAP.  The load on those servers will therefore be reduced.
        #
        eap {
                ok = return
        }

        #
        #  Read the 'users' file
        files

        #
        #  Look in an SQL database.  The schema of the database
        #  is meant to mirror the "users" file.
        #
        #  See "Authorization Queries" in sql.conf
#       sql

        #
        #  If you are using /etc/smbpasswd, and are also doing
        #  mschap authentication, the un-comment this line, and
        #  configure the 'etc_smbpasswd' module, above.
#       etc_smbpasswd

        #
        #  The ldap module will set Auth-Type to LDAP if it has not
        #  already been set
        #ldap

        #
        #  Enforce daily limits on time spent logged in.
#       daily

        #
        # Use the checkval module
#       checkval

        expiration
        logintime
#
        #  If no other module has claimed responsibility for
        #  authentication, then try to use PAP.  This allows the
        #  other modules listed above to add a "known good" password
        #  to the request, and to do nothing else.  The PAP module
        #  will then see that password, and use it to do PAP
        #  authentication.
        #
        #  This module should be listed last, so that the other modules
        #  get a chance to set Auth-Type for themselves.
        #
        pap

    }

    authenticate {

            Auth-Type PAP {
            pap
        }

            Auth-Type CHAP {
                    chap
        }

        Auth-Type MS-CHAP {
                        mschap
                }
            #Auth-Type LDAP {
                    #ldap
            #}

        eap

    }

    session {
    }

    post-auth {
        reply_log
            Post-Auth-Type REJECT {
            attr_filter.access_reject
                reply_log
            update outer.session-state {
                &Module-Failure-Message := &request:Module-Failure-Message
                    }
            }
    }

    pre-proxy {
    }

    post-proxy {
        eap
    }

}
#############

##############
eap {
    default_eap_type = ttls
    timer_expire = 60
    ignore_unknown_eap_types = no
    cisco_accounting_username_bug = no
    max_sessions = ${max_requests}

        md5 {
    }
        leap {
    }
        gtc {
                auth_type = PAP
    }

    tls-config tls-common {
        certificate_file = ${certdir}/eduroam.univ.ma.pem
        private_key_file = ${certdir}/eduroam.univ.ma.key
        # private_key_password = whatever
        ca_file = ${cadir}/univCACert.pem

        # If your AP drops packets towards the client, try reducing this.
        fragment_size = 1024

        # When issuing client certificates embed the OCSP URL in the
        # certificate if you want to be able to revoke them later.
        ocsp {
            enable = yes
            override_cert_url = no
            use_nonce = yes
        }
    }

    tls {
        tls = tls-common
    }

    ttls {
        tls = tls-common
                default_eap_type = gtc
        copy_request_to_tunnel = yes
        use_tunneled_reply = yes
        virtual_server = "inner-tunnel"
    }

    peap {
        tls = tls-common
        default_eap_type = mschapv2
                copy_request_to_tunnel = no
                use_tunneled_reply = no
                virtual_server = "inner-tunnel"
    }

    mschapv2 {
    }
}
##############