Time for action – rejecting requests without a realm

The following steps will demonstrate how to reject requests without a realm:

1. Edit the proxy.conf file under the FreeRADIUS configuration directory and ensure that the my-org.com realm does not have the nostrip directive (it was included in the previous exercise).
2. Edit the sites-enabled/default file and add the following unlang code just after the suffix entry in the authorize section. This will reject any requests with usernames without a realm:

   if( request:Realm == NULL ){
       update reply {
           Reply-Message := "Username should be in format username@domain"
       }
       reject
   }

3. Restart the FreeRADIUS server in debug mode and try to authenticate as alice. The authentication request should fail.
4. Authenticate as [e-mail]. The request should pass.

What just happened?

We have managed to reject any authentication request where a username does not contain a realm.

We had to put the unlang code after the suffix module because...