# MilFA REST module for FreeRADIUS 3.x (rlm_rest, package freeradius-rest).
# Install: copy to /etc/freeradius/3.0/mods-available/milfa and
#          ln -s ../mods-available/milfa /etc/freeradius/3.0/mods-enabled/milfa
#
# FreeRADIUS authenticates to the MilFA Auth API with a client certificate.
# Register the certificate's SHA-256 fingerprint as an mTLS API client of the
# tenant in the MilFA console (tenant -> API clients).
rest milfa {
	tls {
		# CA that issued the MilFA server certificate (CURLOPT_CAINFO; note that
		# rlm_rest's ca_file is CURLOPT_ISSUERCERT, not the trust store).
		ca_info_file     = ${certdir}/milfa/ca.crt
		certificate_file = ${certdir}/milfa/radius.crt
		private_key_file = ${certdir}/milfa/radius.key
		check_cert       = yes
		check_cert_cn    = yes
	}

	connect_uri = "https://milfa.example.local:8443"

	# mode:   challenge (password, then Access-Challenge for the code)
	#         append    (password and code in one field, code = last `digits` characters)
	#         otp       (User-Password is the code; the NAS checks the password itself)
	# groups: filter-id returns the user's MilFA groups as Filter-Id attributes.
	authenticate {
		uri    = "${..connect_uri}/v1/radius/auth?mode=challenge&groups=filter-id"
		method = 'post'
		body   = 'json'
		tls    = ${..tls}
	}

	connect_timeout = 4.0

	pool {
		start        = 0
		min          = 0
		max          = 32
		spare        = 4
		uses         = 0
		retry_delay  = 5
		lifetime     = 0
		idle_timeout = 60
	}
}
