PolicyLogic

{
  "Provider-Name": "My Provider Name",
  "Session-Timeout": "1800",
  "Authenticated-TTL": "1"
}

...
"config": [
  {
    "Provider-Name": "My Provider Name",
    "Authenticated-TTL": "1",
    "Session-Timeout": "1800"
  }
]

{
    "eap": {
        "EAP-Code": "EAP-RESPONSE",
        "EAP-Id": 125,
        "EAP-Lenght": 79,
        "EAP-Type": "EAP-TTLS"
    },
    "request": {
        "Service-Type": "Framed",
        "NAS-IP-Address": "192.168.200.1",
        "NAS-Identifier": "NAS-2",
        "EAP-Message": "0231004f158000000045170303004031e8575fdcf9804ec95333e48d75971a0958a08fd5a5fef63de82bdf27574380e7dea817843716b10c918456b46fed9d1117a9e4d1e4f53bebea1423d27e8ec0",
        "NAS-Port-Type": "19",
        "Framed-MTU": "1400",
        "User-Name": "user@mydomain.com",
        "Calling-Station-Id": "01-02-03-04-05-06",
        "State": "aaa.spheralogic.com;1661152509",
        "Unknown-0-187-0": "000fac04",
        "Unknown-0-186-0": "000fac04",
        "Acct-Session-Id": "42C4B84538D254BB",
        "Message-Authenticator": "f605f97dbd864a5c64716dd5002d58a3",
        "Called-Station-Id": "0C-60-DE-E4-BB-E6:SSID-SECURE",
        "NAS-Port": "1",
        "Connect-Info": "CONNECT 54Mbps 802.11g",
        "Unknown-0-188-0": "000fac01"
    },
    "code": "ACCESS-REQUEST",
    "session": {
        "Spheraaa-Session-Id": "S-1661733604348",
        "Packet-Identifier": 0,
        "Authenticator": "b122f07a22f77a6cba6872dd795d3741",
        "Packet-Length": 333,
        "Source-Host-Port": "192.168.200.1:45969"
    },
    "host": {
        "nasIpAddr": "192.168.200.1",
        "note": "openwrt",
        "type": "OPENWRT",
        "dynPort": "3799",
        "Source-Host-Port": "127.0.0.1:18812"
    },
    "reply": {},
    "config": [
        {
            "proxy": {
                "partners": [
                    {
                        "realms": [
                            "aaa.com",
                            "bbb.com"
                        ],
                        "endpoint": [
                            "1.1.1.1",
                            "aaa.proxyaaa.com"
                        ],
                        "auth-port": "1812",
                        "acct-port": "1813",
                        "name": "PARTNER_1",
                        "timeout": "5000",
                        "timeout-unreachable": "30000",
                        "balance-mode": "random"
                    },
                    {
                        "realms": [
                            "ccc.com"
                        ],
                        "endpoint": "2.2.2.2",
                        "auth-port": "1812",
                        "acct-port": "1812",
                        "name": "PARTNER_2",
                        "timeout": "1000"
                    },
                    {
                        "realms": [
                            "ddd.com"
                        ],
                        "endpoint": "3.3.3.3",
                        "auth-port": "1812",
                        "acct-port": "1813",
                        "name": "PARTNER_3"
                    },
                    {
                        "realms": [
                            "wlan.mnc001.mcc002.3gppnetwork.org",
                            "001_002.net"
                        ],
                        "endpoint": "4.4.4.4",
                        "auth-port": "1812",
                        "acct-port": "1813",
                        "name": "PARTNER_MOBILE"
                    }
                ]
            }
        },
        {
            "Provider-Name": "My Provider Name",
            "Authenticated-TTL": "2",
            "Domain": "mydomain.com",
            "Session-Timeout": "1800"
        }
    ],
    "user": {
        "Identity": "user",
        "Realm": "mydomain.com"
    }
}

  ...,
  "user": {
    "Identity": "user",
    "Realm": "domain.com"
  }

    "user": {
        "IssuerDN": "CN=aaa.spheralogic.com, OU=Wireless, O=SpheraLogic LLC-Root, L=NewYork, ST=NY, C=US",
        "SerialNumber": "10453860482036592703",
        "NotAfter": "Sun Aug 11 22:18:42 EDT 2024",
        "NotBefore": "Fri Aug 12 22:18:42 EDT 2022",
        "Identity": "eap",
        "SubjectDN": "CN=anonymous@company.com, OU=USERID_NAME, O=SpherAAA_LLC-Client, L=NewYork, ST=NY, C=US",
        "SessionID": "62f70ac8005f4821c7db5cd1b838f7bacb5eb567d8927ac32fd5b1a0616bbde1",
        "Realm": "local.com"
    },

var realm = radius.user['Realm'];

radius.reply['Reply-Message'] = "Success Auth";
success();

success("Success Auth");

radius.reply['Reply-Message'] = "Invalid Username or Password";
fail();

fail("Access denided");

const proxyServer = new RadiusProxy();
proxyServer.code = radius.code;
proxyServer.dst = "1.2.3.4"; //radius.proxy['Proxy-Address'] = "1.2.3.4";
proxyServer.dst_port = "1812"; // radius.proxy['Proxy-Address-Port'] = "1812";
proxyServer.timeout = "2000";
proxyServer.name = "MY_PROXY_PROVIDER";
proxyServer.timeout_unreachable = "10000";
proxyServer.balance_mode = "round-robin";
proxyServer.dpd = "false";
const proxyResult = proxyServer.send();
//log(proxyResul);

{"reply":
    {
        "Class":"TYPE=X",
        "Class":"ID=USERID"
    },
    "code":"ACCESS-ACCEPT"
}

{
  "proxy": {
    "partners": [{
        "name": "PARTNER1",
        "realms": ["partner1.com","partner1.net"],
        "endpoint": ["1.1.1.1", "aaa.proxyaaa.com"],
        "auth-port": "1812",
        "acct-port": "1813",
        "name": "PARTNER_1",
        "timeout": "5000",
        "timeout-unreachable": "30000",
        "balance-mode": "random"
      },{
        "name": "DPD-PARTNER",
        "realms": [
          "partner-dpd.com"
        ],
        "endpoint": "someuniquename.com",
        "port": "2083",
        "timeout": "2000",
        "dpd": "true"
      },
      {
        "name": "PARTNER2",
        "realms": [
          "partner2.com"
        ],
        "endpoint": "2.2.2.2",
        "port": "1812",
        "timeout": "2000"
      },
      {
        "name": "PARTNER3",
        "realms": [
          "partner3.com"
        ],
        "endpoint": "3.3.3.3",
        "auth-port": "1812",
        "timeout": "2000"
      }
    ]
  }
}

function doProxyCheck() {
  var realm = radius.user['Realm'];
  var proxySettings = getProxySettings(realm);

  if (!proxySettings) {
    return false;
  }

  var proxyDPD = radius.proxy['Proxy-DPD'];

  var proxyInstance = new RadiusProxy();

  if (proxyDPD) {
    // If Dynamic Peer Discovery is enabled and resolved AAA was never stored by the platform,
    // we must assign the RADSEC server certificate using the certificate ID from
    // "RADSEC Certificates menu, AAA RADSEC Certificates".
    // Example:
    // proxyDPD['cert-id'] = "67b0e41be9433543f0fdfa85";

    // Similarly, set the RADIUS secret if it's different from "radsec" as per RFC.
    // Here, we retrieve it securely from a vault.
    proxyDPD['secret'] = readFromVault("or_secret");
  }

  var proxyResult = proxyInstance.send();
  return proxyResult !== undefined && proxyResult !== null ? proxyResult : false;
}

    // Check for the PPSK Authentication. 
    // Assign VLANs dynamically.
    //
    function checkPPSK() {

    if (radius.request['User-Name'] == radius.request['User-Password']) {
        var dbResult = queryMany("Called-Station-Id", radius.request['Called-Station-Id'], "ppsk");
        if (dbResult) {
            for (i = 0; i <= dbResult.length - 1; i++) {
                radius.reply['tag'][i] = {};
                radius.reply['tag'][i]['Tunnel-Password'] = dbResult[i]['Tunnel-Password'];
                radius.reply['tag'][i]['Tunnel-Private-Group-Id'] = dbResult[i]['Tunnel-Private-Group-Id'];
                radius.reply['tag'][i]['Tunnel-Type'] = dbResult[i]['Tunnel-Type'];
                radius.reply['tag'][i]['Tunnel-Medium-Type'] = dbResult[i]['Tunnel-Medium-Type'];              
            }

            radius.reply['Reply-Message'] = "Success Auth";

            //
            // Store request in the "Session" collection with TTL 1hr
            //
            // function: upsertEntry(collectionName, object, TTL, indexName, indexValue);
            //      
            upsertEntry("sessions", radius.request, 3600, "Calling-Station-Id", radius.request['Calling-Station-Id']);

            success();
            return true;
        }
        return false;
    }
}

{
  "status":"failed"
}

var dbResult = queryOne("User-Name", radius.request['User-Name'], "users");

if(dbResult['result'] != "failed" && dbResult['User-Password'] == radius.request['User-Password'] ){
       radius.reply['Reply-Message'] =  "Success Auth";

        //
        // Store request in the "Session" collection with TTL 1hr
        //
        // function: upsertEntry(collectionName, object, TTL, indexName, indexValue);
        //      
        upsertEntry("sessions", radius.request, 3600, "Calling-Station-Id", radius.request['Calling-Station-Id']);       
        success();
         }

   }

var sessionVar = {
    "AccountId": 123456, 
    "Calling-Station-Id": radius.request['Calling-Station-Id'], 
    "Called-Station-Id": radius.request['Called-Station-Id']
};
insertEntry( "auth_sessions", sessionVar, 86400 );

var sessionVar = {
    "AccountId": 123456, 
    "Calling-Station-Id": radius.request['Calling-Station-Id'], 
    "Called-Station-Id": radius.request['Called-Station-Id']
};
upsertEntry( "auth_sessions", sessionVar, 86400, "Calling-Station-Id",  radius.request['Calling-Station-Id'] );

deteleEntry( "Calling-Station-Id",  radius.request['Calling-Station-Id'], "sessions" );

    // Check for EAP-TTLS Authentication. If an "eap" group is available
    // and if we are not in Inner-Tunnel Auth state, then just return back
    // to EAP-TTLS until handshake process is done and we get Inner-Tunnel
    // credentials.
    //
    if (radius.eap && !radius.request['Inner-Auth-Method']) {
        // Create a new object for handling EAP-TTLS Authentication.        
        var eapttls = new EapTTLS();

        // Use an alternate certificate when a request originates from the realm "otherdomain.com".
        // if (radius.user.Realm == "otherdomain.com" ) {
        //     eapttls.cert_id = "6461706ef4befabdc81e6d1a";
        // }

        // Specify Phase2 Authentication method for this request
        // if (radius.user.Realm == "allowonlypap.com" ) {
        //  eapttls.tunnel_auth = "PAP";
        // }

        // Specify cipher suites for this request
        // if (radius.user.Realm == "specific.com" ) {
        //    eapttls.enabled_ciphers = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384";
        //    eapttls.enabled_tls_versions = "TLSv1.2" ;
        // }

        // Start EAP-TTLS authentication
        var ttlsReturn = eapttls.start();

        // If an error occurs, set the Reply-Message accordingly
        // if (ttlsReturn['eap-error'] !== undefined) 
        //    radius.reply['Reply-Message'] = ttlsReturn['eap-error'];


        // Check if EapTTLS process returned any result
        // Usually it will return EAP Exchange status
        // like: Starting, Handshaking, ApplicationData
        //
        if (ttlsReturn) {
            return;
        }
    }

// This function checks for EAP-TLS authentication using OCSP Responder result and returns a boolean
// more info https://spheralogic.com/wiki/policy/#-ocsp-client

function verifyEapTls(ocsp_enabled) {
    if (radius.request['Inner-Auth-Method'] === "X509") {
        // Check if OCSP is enabled
        if (ocsp_enabled) {
            let certStatus = radius.user.X509.OCSP_Response;

            // Verify the certificate status using OCSP response
            if (certStatus === "good") {
                return true; // Certificate is valid
            } else {
                log("Certificate with Serial Number " + radius.user.X509.SerialNumber + " has been rejected due to the status " + certStatus);
                return false; // Certificate is rejected
            }
        } else {
            // OCSP is disabled, perform internal verification
            if (checkTLSCert()) {
                return true; // Certificate is valid
            }
        }
    } else {
        radius.reply['Reply-Message'] = "Certificate not found";
        return false; // Certificate is not found
    }
}

"user": {
        "3GPP-Identity": {
            "Permanent-Identity": "0123456789012345@wlan.mnc456.mcc123.3gppnetwork.org",
            "Certificate-Serial-Number": "1234567890"
        },
        "Identity": "anonymous",
        "Realm": "wlan.mnc456.mcc123.3gppnetwork.org",
        "Timestamp": "2023/01/01 00:00:00"
    },

var b64 = Base64.encode("test");

output: b64="dGVzdA=="

var text = Base64.decode("dGVzdA==");

output: text="test";

{
  "comment": "Generated by SpherAAA. Root Cert SN 14520661811939377238",
  "created": {
    "$date": 1662143034000
  },
  "expires": {
    "$date": 1725215034000
  },
  "subject": "CN=anonymous@company.com,OU=USERID_NAME,O=SpherAAA-Client,L=City,ST=NY,C=US",
  "issuer": "CN=aaa.spheralogic.com,OU=1,O=SpheraLogic LLC-Root,L=NewYork,ST=NY,C=US",
  "serial_number": "17588163288774580330",
  "revoke_status": false
}

var clear_text = "my private data";
var key = "gSp42mSu75EZaEgZ";

var encryted_text = Crypto.encrypt(clear_text,key);

Output: "jpiGHk7IU21tAoduyXFf7A=="

var encryted_text = "jpiGHk7IU21tAoduyXFf7A==";
var key = "gSp42mSu75EZaEgZ";

var plain_text = Crypto.decrypt(encryted_text,key);

Output: "my private data"

{
    "exists": true,
    "acct": 0,
    "oid": "dd123212-xxxx-4dfxxxx7-xxxx-xxxxxx",
    "platf": "14",
    "puid": "sdfsdf23434234",
    "tid": "123123-3614-12323-8edc-adf342g5t56",
    "unique_name": "user@example.net",
    "upn": "user@example.net"
}

{
  "error": "invalid_grant",
  "error_description": "AADSTS50126: Error validating credentials due to invalid username or password. Trace ID: 3a3bf7a7-5b00-4fc6-af33-36f001615400 Correlation ID: f6d8bcee-2193-4ec5-9b4d-0df48b327ac1 Timestamp: 2024-12-14 01:34:50Z",
  "error_codes": [50126],
  "timestamp": "2024-01-01 00:00:00Z",
  "trace_id": "3a3bf7a7-5b00-4fc6-af33-36f001615400",
  "correlation_id": "f6d8bcee-2193-4ec5-9b4d-0df48b327ac1",
  "error_uri": "https://login.microsoftonline.com/error?code=50126"
}

function EntraIDAuth(username, password) {

  // Read credentials from Vault
  const clientId = readFromVault("client_id");
  const tenantId = readFromVault("tenant_id");
  const clientSecret = readFromVault("client_secret");

  // Validate required parameters
  if (!clientId || !tenantId || !clientSecret) {
    return false;
  }

  // Initialize EntraIDAuth object
  const authClient = new EntraIDAuth();

  // Set parameters for the auth client
  authClient.client_id = clientId;
  authClient.tenant_id = tenantId;
  authClient.client_secret = clientSecret;

  // Attempt authentication
  const response = authClient.checkCredentials(username, password);

  // Check if authentication was successful
  return !!(response && response.exists);
}

function checkUserInEntraID(object) {
  // Read credentials from Vault
  const clientId = readFromVault("client_id");
  const tenantId = readFromVault("tenant_id");
  const clientSecret = readFromVault("client_secret");

  // Validate required parameters
  if (!clientId || !tenantId || !clientSecret) {
    log("Entra ID credentials not found in vault.");
    return false;
  }

  // Initialize EntraIDAuth object
  const authClient = new EntraIDAuth();

  // Set parameters for the auth client
  authClient.client_id = clientId;
  authClient.tenant_id = tenantId;
  authClient.client_secret = clientSecret;

  // Check if the user exists
  const response = authClient.checkUser(object);

  // Return true if the user exists, otherwise false
  return !!(response && response.exists);
}

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
  "businessPhones": [],
  "displayName": "User",
  "givenName": null,
  "jobTitle": null,
  "mail": "user@example.com",
  "mobilePhone": null,
  "officeLocation": null,
  "preferredLanguage": "en",
  "surname": null,
  "userPrincipalName": "user@example.com",
  "id": "34234-324-4dxxxxf7-34234-xxxxxxx",
  "exists": true
}

{
    "error": "Graph API error: HTTP 404",
    "exists": false,
    "details": "{\"error\":{\"code\":\"Request_ResourceNotFound\",\"message\":\"Resource 'user-not-found' does not exist or one of its queried reference-property objects are not present.\",\"innerError\":{\"date\":\"2024-04-30T01:15:08\",\"request-id\":\"xxx-a974-xxxxx-9d88-xxxx\",\"client-request-id\":\"xxxx-a9xxx74-4802-9d88-xxxx\"}}}"
}

  var algo = "HmacSHA256";
  var message  = "users private data";
  var secret_key = "secret";

  var hashed_value = hmac(algo, message, secret_key);

  output: hashed_value="10e80bacf0225e6b3defe6664a7f026f54d021a16a64a38d6ad29a848113e51e"

// Create an instance of HTTPClient
var client = new HTTPClient();

// Set the URL to which the request will be sent
client.url = "http://time.jsontest.com/";

// Send the GET request
try {
  var response = client.send();
  // Log the response
  log(response);
} 
 // Catch exceptions (4XX-5XX and all other errors) 
 catch (e) {
  // Log the received exception.
  log("Error: " + e.toString());
}

{
  "response_code": 200,
  "response_data": {
    "date": "07-30-2022",
    "milliseconds_since_epoch": 1659147162342,
    "time": "02:12:42 AM"
  }
}

// Create an instance of HTTPClient
var client = new HTTPClient();

// Set the URL to which the POST request will be sent
client.url = "https://example.com/api/post-endpoint";

// Set the HTTP method to POST
client.method = "POST";

// Set custom headers if needed (optional)
client.headers = {
  "Content-Type": "application/json", // Assuming you're sending JSON data
  "Authorization": "Bearer YOUR_ACCESS_TOKEN" // Add any authentication headers if required
};

// Disable SSL Verification
client.disableSslVerification = true;

// Define the data to be sent in the request body
client.data = {
  username: "exampleUser",
  password: "examplePassword"
};

// Send the POST request
try {
  var post_response = client.send();
  // Log the response
  log(post_response);
} 
 // Catch exceptions (4XX-5XX and all other errors) 
 catch (e) {
  // Log the received exception.
  log("Error: " + e.toString());
}

{
  "response_code":200,
  "response_data":"Thank you for this dump. I hope you have a lovely day!"
}

var vendor = getVendor(radius.request['Normalized-Mac']);

//Reject all devices manufactured by Apple.
if (vendor == "Apple, Inc.") {
  fail("The use of Apple devices is prohibited.");
  return;
}

//
// Starting point
//

function start() {

    //
    // To avoid delaying the Accounting-Response, execute the Session update function in parallel.
    // So first return Acct-Response
    success();
    //
    // and then insert / update "sessions" collection
    //
    runParallel('acct()', 500);
  }

  //
  // Update sessions collection.
  //
  function acct() {
    // function: upsertEntry(collectionName, object, TTL, indexName, indexValue);
    upsertEntry("sessions", radius.request, 86400, "Calling-Station-Id", radius.request['Calling-Station-Id']);
  }

// Example certificate stored after successful auth
radius.user = {
  "Identity": "anonymous",
  "Realm": "company.com",
  "X509": {
    "IssuerDN": "CN=localhost, OU=asdf, O=site.com-Root, L=Ashburn, ST=VA, C=US",
    "SerialNumber": "645476476316797940957706362354238820466794377162",
    "NotAfter": "Mon Jan 01 20:39:54 EDT 2026",
    "NotBefore": "Sun Jan 01 20:39:54 EDT 2025",
    "SubjectDN": "CN=anonymous@company.com, OU=1471-d4bd-4df7-91f4-29da, O=Company-Client, L=NewYork, ST=NY, C=US"
  }
};

var subject = parseDN(radius.user.X509.SubjectDN);

// Example returned from "subject" object:
// {
//   "CN": "anonymous@company.com",
//   "OU": "1471-d4bd-4df7-91f4-29da",
//   "O": "Company-Client",
//   "L": "NewYork",
//   "ST": "NY",
//   "C": "US"
// }

// Access to CN:
var cn = subject.CN;

// Access to OU: 
var ou = subject.OU;

#### PKI Generate EAP-TLS Certificate

This example demonstrates how to use the `pkiGenCert` function to generate and issue a client certificate suitable for EAP-TLS authentication. The function is invoked with a single object argument that specifies the parameters for the certificate request.

**Request Object Parameters:**

| Key                  | Type   | Description                                                                                                                            |
| -------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------- |
| `ct`                 | String | The two-letter country code (e.g., "US").                                                                                              |
| `st`                 | String | The state or province name (e.g., "NY").                                                                                               |
| `city`               | String | The city or locality name (e.g., "NewYork").                                                                                           |
| `o`                  | String | The organization name (e.g., "Company").                                                                                               |
| `ou`                 | String | The organizational unit name (e.g., "OrganisationUnit").                                                                               |
| `cn`                 | String | The common name for the certificate. For EAP-TLS, this is often an anonymous or user-specific identifier.                                |
| `days`               | String | The number of days the certificate will be valid.                                                                                      |
| `passphrase`         | String | A passphrase to protect the private key. A value of "nopass" indicates no passphrase.                                                  |
| `comment`            | String | A descriptive comment for the certificate.                                                                                             |
| `email_send_as_file` | String | If set to a recipient's email address, the generated certificate will be sent to that address as an attachment. |
| `email_send_as_url`  | String | If set to a recipient's email address, the generated certificate will be sent to that address as a download URL. |
| `ssid`               | String | The SSID for which the certificate is intended. Can be set to a placeholder like "nossid" if not applicable.                            |
| `ca_id`              | String | The unique identifier (From CA/SCEP Menu) of the Certificate Authority that will sign and issue the certificate.                                         |
| `cert_type`          | String | The desired output format for the certificate. Supported formats include `"pem"`, `"p12"`, and `"apple_mobileconfig"`.                   |



The `generateCert` function constructs a certificate request object with all the necessary details for the certificate, such as the subject's distinguished name (Country, State, City, Organization, etc.), validity period, and output format. Once the request object is defined, it's passed to the `pkiGenCert` function to initiate the certificate generation and delivery process. 

Call generateCert(email) to build and submit a certificate request and deliver the generated certificate (or download link) to the specified email address.

```js
// generateCert(email)
// Build a certificate request object and call pkiGenCert() to generate and deliver the cert.
// email - recipient address to send the generated certificate as a file (if email_send_as_file is set).
function generateCert(email) {
  var cert_request = {
    // Subject fields
    "ct": "US",                         // Country (2-letter code)
    "st": "NY",                         // State or province
    "city": "NewYork",                  // City / Locality
    "o": "Company",                     // Organization
    "ou": "OrganisationUnit",           // Organizational Unit
    "cn": "anonymous@company.com",      // Common Name (often used for user identifier)

    // Validity & protection
    "days": "365",                      // Validity period in days
    "passphrase": "nopass",             // "nopass" = no private key passphrase

    // Metadata / delivery
    "comment": "EAP-TLS Client Cert",   // Human-readable comment
    "email_send_as_file": email,        // If set to email addresss value, send a cert as an attachment
    "email_send_as_url": false,         // If set to email addresss value, send a download URL instead of attaching the file

    // Certificate usage / CA / format
    "ssid": "nossid",                   // Optional SSID tag for the cert (use "nossid" if not applicable)
    "ca_id": "687aa36926d95d8920665d72",// CA certificate ID to sign the client cert
    "cert_type": "apple_mobileconfig"   // Output format: "pem", "p12", or "apple_mobileconfig"
  };

  // Submit the request to the PKI generator which will create and deliver the certificate.
  pkiGenCert(cert_request);
}

// Store OAuth access token in the vault. 
writeToVault("access_token", "64a38d6ad29a848113e51e", 3600, "oauth access token");

var access_token = readFromVault("access_token");
// Returns 64a38d6ad29a848113e51e