Realms and subrealms explanation

[Snowmanko]

Hi all,

i am trying to implement tac_plus-ng with multiple realms but it seems that only default realm is working for me.
Can someone explain if it is possible to create subrealms under default realm? To make it more clear i am adding my example configuration.

I believe tenant1-router should match subrealm tenant1. But it does not work, tenant2-router have same problem.

#!../../../sbin/tac_plus-ng

# spawnd: single port for all realms
id = spawnd {
    listen { port = 49 }
}

# tac_plus-ng server
id = tac_plus-ng {

    # MAVIS: system users and groups
    mavis module = groups {
        resolve gids = yes
        resolve gids attribute = TACMEMBER
        groups filter = /^(aaa-login|admin|helpdesk)$/
    }
    mavis module = external {
        exec = /usr/local/sbin/pammavis "pammavis" "-s" "sshd"
    }
    user backend = mavis
    login backend = mavis chpass
    pap backend = mavis

    # Logging
    log mainlog {
        destination = "/var/log/tac_plus/tac_plus-%Y-%m-%d.log"
    }
    log acctlog {
        destination = "/var/log/tac_plus/tac_plus_acct-%Y-%m-%d.log"
    }
    authentication log = mainlog
    authorization log = mainlog
    accounting log = acctlog

    # Groups (must be declared for rule matching)
    group aaa-login
    group admin
    group helpdesk

    # Realm: TENANT 1
    realm tenant1 {
        profile priv {
            script {
                if (service == shell) {
                    if (cmd == "") { set priv-lvl = 15; permit }
                }
                permit
            }
        }

        ruleset {
            rule group-map {
                enabled = yes
                script {
                    if (group == aaa-login) { profile = priv permit }
                    deny
                }
            }
        }
    }

    # Realm: TENANT 2
    realm tenant2 {
        profile priv10 {
            script {
                if (service == shell) {
                    if (cmd == "") { set priv-lvl = 10; permit }
                }
                permit
            }
        }

        ruleset {
            rule group-map {
                enabled = yes
                script {
                    if (group == aaa-login) { profile = priv10 permit }
                    deny
                }
            }
        }
    }

    # Realm: MIGRATION
    realm migration {
        profile readonly {
            script {
                if (service == shell) {
                    if (cmd == "") { set priv-lvl = 1; permit }
                }
                permit
            }
        }

        ruleset {
            rule group-map {
                enabled = yes
                script {
                    if (group == aaa-login) { profile = readonly permit }
                    deny
                }
            }
        }
    }
    
    # Device mapping at top-level with target-realm routing
    device tenant1-router {
        key = "key2025"
        address = 172.19.96.41/32
        target-realm = tenant1
    }

    device tenant2-router {
        key = "demo"
        address = 10.202.6.18/32
        target-realm = tenant2
    }

    device migration-router {
        key = "MigrationKey"
        address = 10.0.2.1/32
        target-realm = migration
    }
}

[MarcJHuber]

Hi,

thanks for reaching out and reporting. f56cc9d should fix this, please git pull and retry.

Cheers,

Marc

[MarcJHuber]

Hi,

forgot to mention that: hosts (more exactly: hosts with the corresponding IPv4/IPv6 addresses) must be defined in the "target realm", too.

Target realm efinitions in the default realm don't require any attributes beside "address" and "target-realm".

realm tenant1 { 
    device tenant2 {
        key = "key2025"
        address = 172.19.96.41/32
    }
  profile ...
}

 device tenant1-router {
        address = 172.19.96.41/32
        target-realm = tenant1
}

Cheers,

Marc

[Snowmanko]

Hi Marc,
thanks for patch, it works as expected.

But are you sure i have to double configure same host in default realm (with target-realm attribute) and also same host inside realm (in your example under tenant1)? I think you can define devices like this:

define device in default realm (with target-realm attribute)

id = tac_plus-ng {
  realm tenant1 { 
    script ...
    profile ...
  }
  # device in default realm with "forwarding" to target-realm
  device device-of-tenant1-realm {
     key = "key2025"
     address = 172.19.96.41/32
     target-realm = tenant1
  }
}

[MarcJHuber]

Hi,

thanks, I think you're right, a closer look at the code reveals that having the host definition in a sub-realm isn't required. I've remembered this wrong, sorry for the misinformation!

Cheers,

Marc