freeradius: minimal config for attr_filter

roles/freeradius/defaults/main.yml

@@ -4,7 +4,7 @@ radiusd__status_server: true
 radiusd__clients: {}
 radiusd__enabled_modules_minimal:
   - always
-  - attr_filter # TODO
+  - attr_filter
   - cache_eap # TODO
   - detail # TODO
   - detail.log # TODO

roles/freeradius/tasks/main.yml

@@ -52,6 +52,8 @@
     - mods-available/always
     - mods-available/eap
     - mods-available/eap_inner
+    - mods-config/attr_filter/access_challenge
+    - mods-config/attr_filter/access_reject
   notify:
     - Restart freeradius
 

roles/freeradius/templates/mods-available/attr_filter.j2

@@ -0,0 +1,11 @@
+{{ ansible_managed | comment }}
+
+attr_filter attr_filter.access_reject {
+    key = "%{User-Name}"
+    filename = ${modconfdir}/${.:name}/access_reject
+}
+
+attr_filter attr_filter.access_challenge {
+    key = "%{User-Name}"
+    filename = ${modconfdir}/${.:name}/access_challenge
+}

roles/freeradius/templates/mods-config/attr_filter/access_challenge.j2

@@ -0,0 +1,10 @@
+{{ ansible_managed | comment }}
+
+DEFAULT
+	EAP-Message =* ANY,
+	State =* ANY,
+	Message-Authenticator =* ANY,
+	Reply-Message =* ANY,
+	Proxy-State =* ANY,
+	Session-Timeout =* ANY,
+	Idle-Timeout =* ANY

roles/freeradius/templates/mods-config/attr_filter/access_reject.j2

@@ -0,0 +1,10 @@
+{{ ansible_managed | comment }}
+
+DEFAULT
+	EAP-Message =* ANY,
+	State =* ANY,
+	Message-Authenticator =* ANY,
+	Error-Cause =* ANY,
+	Reply-Message =* ANY,
+	MS-CHAP-Error =* ANY,
+	Proxy-State =* ANY