net/freeradius: Allow LDAP in inner-tunnel (#2626)

net/freeradius/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.9.18
+PLUGIN_VERSION=		1.9.19
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

net/freeradius/pkg-descr

@@ -15,6 +15,10 @@ The server is fast, feature-rich, modular, and scalable.
 Plugin Changelog
 ================
 
+1.9.19
+
+* Allow to use LDAP in inner-tunnel (needed for LDAP authentication within 802.1X)
+
 1.9.18
 
 * Added support for fallback VLAN

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml

@@ -1,4 +1,10 @@
 <form>
+    <field>
+        <id>ldap.innertunnel</id>
+        <label>Inner-Tunnel LDAP</label>
+        <type>checkbox</type>
+        <help>This enables LDAP authentication in inner-tunnel configuration. This is needed for protocols requiring encrypted authentication like 802.1X.</help>
+    </field>
     <field>
         <id>ldap.protocol</id>
         <label>Protocol Type</label>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml

@@ -1,8 +1,12 @@
 <model>
     <mount>//OPNsense/freeradius/ldap</mount>
     <description>LDAP configuration</description>
-    <version>1.0.0</version>
+    <version>1.0.1</version>
     <items>
+        <innertunnel type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </innertunnel>
         <protocol type="OptionField">
             <default>LDAPS</default>
             <Required>Y</Required>

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-inner-tunnel

@@ -155,7 +155,16 @@ authorize {
 
         #
         #  The ldap module reads passwords from the LDAP database.
+{%   if helpers.exists('OPNsense.freeradius.ldap.innertunnel') and OPNsense.freeradius.general.ldap.innertunnel == '1' %}
+        ldap
+          if ((ok || updated) && User-Password) {
+              update control {
+                  Auth-Type := ldap
+              }
+          }
+{%  else %}
         -ldap
+{%  endif %}
 
         #
         #  Enforce daily limits on time spent logged in.
@@ -242,9 +251,11 @@ authenticate {
         #  authentication server, and knows what to do with authentication.
         #  LDAP servers do not.
         #
+{%   if helpers.exists('OPNsense.freeradius.ldap.innertunnel') and OPNsense.freeradius.general.ldap.innertunnel == '1' %}
 #       Auth-Type LDAP {
 #               ldap
 #       }
+{%   endif %}
 
         #
         #  Allow EAP authentication.