# MilFA virtual server for FreeRADIUS 3.x.
# Install: copy to /etc/freeradius/3.0/sites-available/milfa,
#          ln -s ../sites-available/milfa /etc/freeradius/3.0/sites-enabled/milfa
#          and remove sites-enabled/default and sites-enabled/inner-tunnel
#          (or change their ports) so that this server owns UDP 1812.
# NAS clients are declared in clients.conf (see clients.conf.example).
server milfa {
	listen {
		type   = auth
		ipaddr = *
		port   = 1812
	}

	authorize {
		filter_username
		if (!&User-Password) {
			update reply {
				&Reply-Message := "PAP (User-Password) is required"
			}
			reject
		}
		update control {
			&Auth-Type := milfa
		}
	}

	authenticate {
		Auth-Type milfa {
			milfa
			# MilFA asks for the one-time code: send Access-Challenge.
			if (&control:Response-Packet-Type == Access-Challenge) {
				handled
			}
			# rlm_rest returns "updated" when the response carries attributes;
			# the authenticate section accepts only "ok".
			elsif (updated) {
				ok
			}
		}
	}

	post-auth {
		Post-Auth-Type REJECT {
			attr_filter.access_reject
		}
	}
}
