claude-botandClaude Opus 5.5
bc698ea22d
Outer identity anonymous[@realm] (any case) keeps the local EAP-TTLS -> authentik path. Any other outer identity is a UniFi Endpoint account: the outer server proxies every EAP round to new home server udm (10.2.47.1:1812, UDM_RADIUS_SECRET) without local EAP processing; post-proxy/post-auth leave UDM replies untouched. Endpoint account names look like ordinary usernames, so routing keys on the anonymous identity, not a name pattern. home_server udm: response_window 5 < proxy_dedup_window 10, require_message_authenticator yes (RFC 3579, EAP replies), status_check request with a user name that cannot exist. CNP freeradius-udm-egress allows only 10.2.47.1/32 UDP 1812. Harness: mock_udm.py on a second internal bridge at the udm address from proxy.conf. Asserts both EAP rounds (State included) reach it, its Accept reaches the NAS with Tunnel-* VLAN 200 and MS-MPPE keys intact, its Reject passes, and anonymous logins and accounting never reach it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>