#
# proxy.conf - proxy radius and realm configuration directives
#
# This file is included by default.  To disable it, you will need
# to modify the PROXY CONFIGURATION section of "radiusd.conf".
#



#
#  This entry controls the servers behaviour towards ALL other servers
#  to which it sends proxy requests.
#
proxy server {
	#
	#  Note that as of 2.0, the "synchronous", "retry_delay",
	#  "retry_count", and "dead_time" have all been deprecated.
	#  For backwards compatibility, they are are still accepted
	#  by the server, but they ONLY apply to the old-style realm
	#  configuration.  i.e. realms with "authhost" and/or "accthost"
	#  entries.
	#
	#  i.e. "retry_delay" and "retry_count" have been replaced
	#  with per-home-server configuration.  See the "home_server"
	#  example below for details.
	#
	#  i.e. "dead_time" has been replaced with a per-home-server
	#  "revive_interval".  We strongly recommend that this not
	#  be used, however.  The new method is much better.

	#
	#  In 2.0, the server is always "synchronous", and setting
	#  "synchronous = no" is impossible.  This simplifies the
	#  server and increases the stability of the network.
	#
	#  If you need to set "synchronous = no", please send a
	#  message to the list <freeradius-users@lists.freeradius.org>
	#  explaining why this feature is vital for your network.

	#
	#  If a realm exists, but there are no live home servers for
	#  it, we can fall back to using the "DEFAULT" realm.  This is
	#  most useful for accounting, where the server can proxy
	#  accounting requests to home servers, but if they're down,
	#  use a DEFAULT realm that is LOCAL (i.e. accthost = LOCAL),
	#  and then store the packets in the "detail" file.  That data
	#  can be later proxied to the home servers by radrelay, when
	#  those home servers come back up again.	

	#  Setting this to "yes" may have issues for authentication.
	#  i.e. If you are proxying for two different ISP's, and then
	#  act as a general dial-up for Gric.  If one of the first two
	#  ISP's has their RADIUS server go down, you do NOT want to
	#  proxy those requests to GRIC.  Instead, you probably want
	#  to just drop the requests on the floor.  In that case, set
	#  this value to 'no'.
	#
	#  allowed values: {yes, no}
	#
#	default_fallback = no
	default_fallback = yes

}

#######################################################################
#
#  Configuration for the proxy realms.
#
#  As of 2.0. the old-style "realms" file is deprecated, and is not
#  used by FreeRADIUS.
#
#  As of 2.0, the "realm" configuration has changed.  Instead of
#  specifying "authhost" and "accthost" in a realm section, the home
#  servers are specified seperately in a "home_server" section.  For
#  backwards compatibility, you can still use the "authhost" and
#  "accthost" directives.  If you only have one home server for a
#  realm, it is easier to use the old-style configuration.
#
#  However, if you have multiple servers for a realm, we STRONGLY
#  suggest moving to the new-style configuration.
#
#
#  Load-balancing and failover between home servers is handled via
#  a "server_pool" section.
#
#  Finally, The "realm" section defines the realm, some options, and
#  indicates which server pool should be used for the realm.
#
#  This change means that simple configurations now require multiple
#  ssections to define a realm.  However, complex configurations
#  are much simpler than before, as multiple realms can share the same
#  server pool.
#
#  That is, realms point to server pools, and server pools point to
#  home servers.  Multiple realms can point to one server pool.  One
#  server pool can point to multiple home servers.  Each home server
#  can appear in one or more pools.
#

######################################################################
#
#
#  This section defines a new-style "realm".  Note the in version 2.0,
#  there are many fewer configuration items than in 1.x for a realm.
#
#  Automatic proxying is done via the "realms" module (see "man
#  rlm_realm").  To manually proxy the request put this entry in the
#  "users" file:

#
#
#DEFAULT	Proxy-To-Realm := "realm_name"
#
#
# Il faut mettre dead_time à 0 pour que la panne d'un Radius d'un membre 
# EduRoam n'entraine pas l'arret du Radius Proxy Eduroam.
dead_time = 0
realm DEFAULT {
	type        = radius
	# TEST : Le serveur de listes me sert de proxy Eduroam
	# A VIRER !!!
	authhost = listes.grenoble.cnrs.fr:1812
	accthost = listes.grenoble.cnrs.fr:1813
	#    authhost	= rad1.eduroam.fr:1812
	#    accthost	= rad1.eduroam.fr:1813
	secret      = secretpartage
	nostrip
}

#  This realm is used mainly to cancel proxying.  You can have
#  the "realm suffix" module configured to proxy all requests for
#  a realm, and then later cancel the proxying, based on other
#  configuration.
#
#  For example, you want to terminate PEAP or EAP-TTLS locally,
#  you can add the following to the "users" file:
#
#  DEFAULT EAP-Type == PEAP, Proxy-To-Realm := LOCAL
#
###############################################################################
### ATTENTION !!! ATTTENTION !!! ATTENTION !!!
### Pour les realms locaux, il ne FAUT PAS mettre de pool de serveur (il ne 
### faut rien mettre du tout). Sinon on a une generation de boucle dans les 
### proxies !!!!
###############################################################################
realm LOCAL {
	#  If we do not specify a server pool, the realm is LOCAL, and
	#  requests are not proxied to it.
}

#
#  This realm is for requests which don't have an explicit realm
#  prefix or suffix.  User names like "bob" will match this one.
#
#realm NULL {
#	type		= radius
#	authhost	= radius.company.com:1600
#	accthost	= radius.company.com:1601
#	secret		= testing123
#}
## realm NULL definit pour authentifier les utilisateurs en local.
realm NULL {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

#
#  This realm is for ALL OTHER requests.
#
#realm DEFAULT {
#	type		= radius
#	authhost	= radius.company.com:1600
#	accthost	= radius.company.com:1601
#	secret		= testing123
#}

realm creta {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

realm g2elab {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

# Le realm grenoble.cnrs.fr est utilise de l'exterieur (utilisateurs de Grenoble à 
# Toulouse). Dans ce cas, l'utilisateur ne doit PAS donner son labo.
realm grenoble.cnrs.fr {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
	nostrip
}

realm lcmi {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

realm lpm2c {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

realm mcbt{
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

realm mcmf {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

realm nano {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}

realm test {
	type            = radius
	authhost        = LOCAL
	accthost        = LOCAL
}
