modules {

  pap {
    auto_header = yes
  }

  files {
    usersfile = ${confdir}/users
    acctusersfile = /dev/null
    preproxy_usersfile = /dev/null
    compat = no
  }

}

server {

  authorize {
    files
    pap
  }

  authenticate {
    Auth-Type PAP {
      group pap-with-message {
        # pap returns either fail or noop or ok or reject
        pap {
          # default for ok on authenticate would be to return
          ok = 2
          # default for reject on authenticate would be to return
          reject = 2
        }
        if (ok) {
          # the following line is the unintentional workaround
          # to make the elsif work
          reject = 2
          # update returns updated with priority 1
          update reply {
            Reply-Message := "pap authenticate returned OK"
          }
        }
        elsif (reject) {
          update reply {
            Reply-Message := "pap authenticate returned REJECT"
          }
        }
      }
      # override updated from above thus preserving ok/reject from pap
      ok = return
      reject = return
    }
  }

}
