<?xml version='1.0' encoding='utf-8'?>

<creole>
    <files>
        <file filelist='freeradius_tls' mode='640' name='/usr/share/eole/freeradius-certs.d/base/certs/ca.cnf' source='freerad-ca.cnf' mkdir='True'/>
        <file filelist='freeradius_tls' mode='640' name='/usr/share/eole/freeradius-certs.d/base/certs/client-tmpl.cnf' source='freerad-client.cnf' mkdir='True'/>
        <file filelist='freeradius_tls' mode='640' name='/usr/share/eole/freeradius-certs.d/base/certs/server.cnf' source='freerad-server.cnf' mkdir='True'/>
    </files>
    <containers>
        <container name="radius" id="28">
            <package>eole-radius-pkg</package>
            <service servicelist='freeradius'>freeradius</service>
            <service_access service='freeradius'>
                <port protocol="udp">1812</port>
            </service_access>
            <service_access service='freeradius_accounting'>
                <port protocol="udp">1813</port>
            </service_access>
            <service_restriction service='freeradius'>
                <ip interface='auto' ip_type='SymLinkOption'>freerad_nas_ip</ip>
            </service_restriction>
            <service_restriction service='freeradius_accounting'>
                <ip interface='auto' ip_type='SymLinkOption'>freerad_nas_ip</ip>
            </service_restriction>
            <file name='/etc/systemd/system/freeradius.service.d/override.conf' source='freeradius.override.container' mkdir='True' rm='True' instance_mode='when_container'/>
            <file name='/etc/logrotate.d/freeradius' source='freeradius.logrotate'/>
            <file filelist='freeradius' mode='640' group='freerad' name='/etc/freeradius/3.0/clients.conf' source='freerad-clients.conf'/>
            <file filelist='freeradius_mod_files' mode='640' group='freerad' name='/etc/freeradius/3.0/mods-config/files/authorize' source='freerad-authorize' mkdir='True'/>
            <file filelist='freeradius_mod_preprocess' mode='640' group='freerad' name='/etc/freeradius/3.0/mods-config/preprocess/huntgroups' source='freerad-huntgroups' mkdir='True'/>

            <file filelist='freeradius_ldap' mode='640' group='freerad' name='/etc/freeradius/3.0/mods-enabled/ldap' source='freerad-ldap' mkdir='True'/>
            <file filelist='freeradius_tls' mode='640' group='freerad' name='/etc/freeradius/3.0/mods-enabled/eap' source='freerad-eap' mkdir='True'/>
        </container>
        <container name="internet" id="53" />
        <container name="radius" group="internet" />
    </containers>
    <variables>
        <family name='services'>
            <variable name='activer_freeradius' type='oui/non' description='Activer le service FreeRADIUS'>
                <value>non</value>
            </variable>
        </family>
        <family name='freeradius' icon='bullseye'>

            <!-- Configuration des Network Access Servers -->
            <variable name='freerad_nas_ip' type='ip' description="Adresse IP du serveur d'accès (NAS)" multi='True' mandatory='True'/>
            <variable name='freerad_nas_cidr_netmask' type='number' description="Masque de sous réseau (notation CIDR) du serveur d'accès (NAS)" mandatory='True'/>
            <variable name='freerad_nas_name' type='string' description="Nom court du serveur d'accès (NAS)" mandatory='True'/>
            <variable name='freerad_nas_passwd' type='password' description="Secret partagé avec le serveur d'accès (NAS)" mandatory='True'/>
            <variable name='freerad_nas_type' type='string' description="Type du serveur d'accès (NAS)" mandatory='True'>
                <value>other</value>
            </variable>

            <!-- Profil global -->
            <variable name='freeradius_profile' type='string' description='Profil d’utilisation' mode='basic' mandatory='True'/>

            <!-- Configuration globale -->
            <variable name='freerad_log_auth' type='oui/non' description='Journaliser les authentifications'>
                <value>oui</value>
            </variable>
            <variable name='freerad_log_goodpass' type='oui/non' description='Journaliser les authentifications réussies'>
                <value>oui</value>
            </variable>
            <variable name='freerad_log_badpass' type='oui/non' description='Journaliser les authentifications échouées'>
                <value>oui</value>
            </variable>

            <!-- Variables pour les active_tags d’era -->
            <variable name='freerad_era_used' type='string' description="Variable intermédiaire pour l’activation des variables spécifiques à ERA" hidden="True"/>
            <variable name='freerad_listen_int' type='string' description="Numéro de l'interface sur laquelle FreeRADIUS écoutera" mandatory='True' />
            <variable name='freerad_listen_addr' type='ip' description='Adresse IP sur laquelle FreeRADIUS écoutera' mandatory='True' />
            <variable name='freeradius_custom_pki' type='oui/non' description='Configurer la pki'>
                <value>non</value>
            </variable>
            <variable name='freeradius_custom_pki_auto' type='oui/non' description='Variable intérmédiaire pour la gestion automatisée de la pki' hidden='True'/>
            <variable name='freeradius_pki_needed' type='oui/non' hidden='True'/>
            <variable name='freeradius_pki_server_password' type='password' auto_freeze='True' hidden='True'/>
            <variable name='freeradius_pki_ca_password' type='password' auto_freeze='True' hidden='True'/>
            <variable name='freeradius_pki_default_days' type='number' hidden='True'>
                <value>365</value>
            </variable>
            <variable name='freeradius_custom_ldap' type='oui/non' description='Configurer le module ldap'>
                <value>non</value>
            </variable>
            <variable name='freeradius_custom_ldap_auto' type='oui/non' description='Variable intermédiaire pour l’accès à la configuration du module ldap' hidden='True'/>
            <variable name='freeradius_mod_ldap_needed' type='oui/non' hidden='True'/>

            <!-- Configuration annuaire -->
            <variable name='freerad_ldap_ip' type='domain' description='Adresse du serveur LDAP permettant de récupérer les comptes utilisateurs' mandatory='True'/>
            <variable name='freerad_ldap_base_dn' type='string' description="Suffixe racine de l'annuaire LDAP " mode='basic' mandatory='True'>
                <value>o=gouv,c=fr</value>
            </variable>
            <variable name='freerad_ldap_cn' type='string' description='CN du compte de consultation de l’annuaire' mode='basic'>
                <value>reader</value>
            </variable>
            <variable name='freerad_ldap_bind_dn' type='string' description='DN du compte de consultation de l’annuaire' hidden='True'/>
            <variable name='freerad_ldap_password_file' type='filename' description="Chemin du fichier de mot de passe du compte de consultation" mandatory='True' mode='basic'>
                <value>/root/.reader</value>
            </variable>

            <!-- Configuration du filtrage d’accès -->
            <variable name='freerad_ldap_group' type='unix_user' description="Groupe d'utilisateurs à récupérer dans l'annuaire LDAP" multi='True' mandatory='True'/>
            <variable name='freerad_group_vlan' type='number' description="Numéro de VLAN à attribuer à ce groupe" mandatory='True'/>

        </family>

        <separators>
            <separator name='freerad_nas_ip'>Configuration des NAS</separator>
            <separator name='freeradius_profile'>Profil d’utilisation et options globales</separator>
            <separator name='freerad_ldap_group'>Configuration des groupes et des VLAN</separator>
        </separators>
    </variables>
    <constraints>
        <check name='valid_enum' target='freeradius_profile'>
            <param type='python'>eosfunc.list_files("/usr/share/eole/freeradius-profiles.d", default=['ldap', 'ldap+acc', 'tls', 'tls+acc'], files=False, exception="base", substring=False)</param>
            <param name='checkval'>False</param>
        </check>
        <condition name='disabled_if_in' source='activer_freeradius'>
            <param>non</param>
            <target type='family'>freeradius</target>
            <target type='filelist'>freeradius</target>
            <target type='servicelist'>freeradius</target>
        </condition>
        <condition name='disabled_if_in' source='freerad_era_used'>
            <param>era not found</param>
            <target type='variable'>freerad_listen_int</target>
            <target type='variable'>freerad_listen_addr</target>
        </condition>
        <condition name='disabled_if_not_in' source='freeradius_mod_ldap_needed'>
            <param>oui</param>
            <target type='filelist'>freeradius_ldap</target>
            <target type='variable'>freerad_ldap_ip</target>
            <target type='variable'>freerad_ldap_base_dn</target>
            <target type='variable'>freerad_ldap_cn</target>
            <target type='variable'>freerad_ldap_bind_dn</target>
            <target type='variable'>freerad_ldap_password_file</target>
        </condition>
        <condition name='disabled_if_not_in' source='freeradius_profile'>
            <param>ldap</param>
            <param>ldap+acc</param>
            <target type='variable'>freerad_ldap_group</target>
            <target type='variable'>freerad_group_vlan</target>
            <target type='filelist'>freeradius_mod_files</target>
            <target type='filelist'>freeradius_mod_preprocess</target>
        </condition>
        <auto name='calc_val_first_value' target='freeradius_custom_ldap_auto'>
            <param type='eole' optional='True' hidden='False'>freeradius_custom_ldap</param>
            <param>non</param>
        </auto>
        <auto name='concat' target='freerad_ldap_bind_dn'>
            <param>CN=</param>
            <param type='eole'>freerad_ldap_cn</param>
            <param>,</param>
            <param type='eole'>freerad_ldap_base_dn</param>
        </auto>
        <auto name='calc_multi_condition' target='freeradius_mod_ldap_needed'>
            <param>['ldap', 'ldap+acc', 'oui']</param>
            <param name='operator'>OR</param>
            <param name='condition_1' type='eole'>freeradius_profile</param>
            <param name='condition_2' type='eole'>freeradius_profile</param>
            <param name='condition_3' type='eole'>freeradius_custom_ldap_auto</param>
            <param name='match'>oui</param>
            <param name='mismatch'>non</param>
        </auto>

        <auto name='calc_val_first_value' target='freeradius_custom_pki_auto'>
            <param type='eole' optional='True' hidden='False'>freeradius_custom_pki</param>
            <param>non</param>
        </auto>
        <auto name='calc_val_first_value' target='freerad_era_used'>
            <param type='eole' optional='True' hidden='False'>type_amon</param>
            <param>era not found</param>
        </auto>
        <auto name='calc_multi_condition' target='freeradius_pki_needed'>
            <param>['tls', 'tls+acc', 'ldap', 'ldap+acc', 'oui']</param>
            <param name='operator'>OR</param>
            <param name='condition_1' type='eole'>freeradius_profile</param>
            <param name='condition_2' type='eole'>freeradius_profile</param>
            <param name='condition_3' type='eole'>freeradius_profile</param>
            <param name='condition_4' type='eole'>freeradius_profile</param>
            <param name='condition_5' type='eole'>freeradius_custom_pki_auto</param>
            <param name='match'>oui</param>
            <param name='mismatch'>non</param>
        </auto>
        <condition name='disabled_if_in' source='freeradius_profile'>
            <param>ldap</param>
            <param>ldap+acc</param>
            <param>tls</param>
            <param>tls+acc</param>
            <target type='variable'>freeradius_custom_pki</target>
        </condition>
        <condition name='disabled_if_in' source='freeradius_profile'>
            <param>ldap</param>
            <param>ldap+acc</param>
            <param>tls</param>
            <param>tls+acc</param>
            <target type='variable'>freeradius_custom_ldap</target>
        </condition>
        <condition name='disabled_if_not_in' source='freeradius_pki_needed'>
            <param>oui</param>
            <target type='filelist'>freeradius_tls</target>
            <target type='variable'>freeradius_pki_server_password</target>
            <target type='variable'>freeradius_pki_ca_password</target>
            <target type='variable'>freeradius_pki_default_days</target>
        </condition>

        <fill name='gen_random' target='freeradius_pki_server_password'/>
        <fill name='gen_random' target='freeradius_pki_ca_password'/>

        <check name='valid_enum' target="freerad_listen_int">
            <param>['0', '1', '2', '3', '4']</param>
        </check>
        <check name="valid_enum" target='freerad_nas_type'>
            <param>['cisco','computone','livingston','max40xx','multitech','netserver','pathras','patton','portslave','tc','usrhiper','other']</param>
        </check>
        <check name="valid_enum" target='freerad_ldap_group'>
            <param>['eleves','professeurs']</param>
            <param name="checkval">False</param>
        </check>
        <!-- **** Groupes **** -->
        <group master='freerad_nas_ip'>
            <slave>freerad_nas_cidr_netmask</slave>
            <slave>freerad_nas_passwd</slave>
            <slave>freerad_nas_name</slave>
            <slave>freerad_nas_type</slave>
        </group>
        <group master='freerad_ldap_group'>
            <slave>freerad_group_vlan</slave>
        </group>
    </constraints>
    <help>
        <family name='freeradius'>Paramétrage de l'authentification RADIUS</family>
        <variable name='activer_freeradius'>RADIUS (Remote Authentication Dial-In User Service) est un protocole client-serveur permettant de centraliser des données d'authentification</variable>
        <variable name='freerad_nas_cidr_netmask'>Masque au format CIDR (255.255.255.0 -> 24)</variable>
    </help>
</creole>
<!-- vim: ts=4 sw=4 expandtab
-->
