Using Extension Points

The process for creating and implementing a script involves:

When on the other hand, you would like to affect the response, such as setting a specific timeout when there is not one, you would reference the script as an outgoing script.

In order to be able to create a script, you need to understand the way Cisco Access Registrar processes client requests. Cisco Access Registrar processes requests and responses in a hierarchical fashion; incoming requests are processed from the most general to the most specific levels, whereas, outgoing responses are processed from the most specific to the most general levels. Extension points are available at each level.

• RADIUS server

• Vendor (of the immediate client)

• Client (individual NAS)

• NAS-Vendor-Behind-the-Proxy

• Client-Behind-the-Proxy

• Service

An authentication or authorization script can be referenced at each of the following extension points:

• Group Authentication

• User Authentication

• Group Authorization

• User Authorization

• Session Management

The outgoing script can be referenced at each of the following extension points:

To write a script, do the following:

Step 2 Give it a name.

Step 3 Define one or more procedures, using the following syntax:

proc name {request response environment}
{Body}

Step 4 Create the body of the script.

Step 5 Save the file and copy it to the /opt/AICar1/scripts/radius/tcl directory, or to the location you chose when you installed Cisco Access Registrar.

The following examples show scripts using all three dictionaries.

The put method has the syntax: <$dict> put <attribute value>[<index>]. In this example, <$request> refers to the Request dictionary and the attribute is NAS-IP-Address. The put method sets the NAS's IP address attribute.

Note the function, regsub, is a Tcl function.

proc ParseProxyHints {request response environment} {
    set userName [ $request get User-Name ]
    if { [ regsub "@radius" $userName "" newUserName ] } {
	$request put User-Name $newUserName
	$radius put Authentication-Service "radius-proxy"
	$radius put Authorization-Service "radius-proxy"
	$radius put Accounting-Service "radius-proxy"
    } else {
    if { [ regsub "@tacacs" $userName "" newUserName ] } {
	$request put User-Name
	$radius put Authentication-Service "tacacs-client"
    } }
}

• Specifying the script definition; it must include the following:

  • Name---used in other places in the configuration to refer to the script. It must be unique among all other scripts.

  • Language---can be either Tcl or REX (shared libraries)

  • Filename---the name you used when you created the file

  • Entrypoint---the function name.

The rule of thumb to use in determining where to add the script is the most general scripts should be on the outermost points, whereas the most specific scripts should be on the innermost points.