From users file to SQL

[David Majorel]

It doesn't work. When the user is member of SUSPENDED and has a static IP 
address, rlm_sqlippool doesn't override the Framed-IP-Address.
This is the behavior I expect for all other cases/groups.

I had another problem with this configuration. A user can be member of 
multiple groups. If he is member of SUSPENDED, I want it to be the only one 
group evaluated. This can be achieved with "Fall-Though" in users file, but 
it don't know how to do it with SQL.

Finally, I tried to use SQL-Group in users file (see below). I can pull user 
attributes from database after processing group attributes in users file. 
Nevertheless, I still have a problem with group SUSPENDED. I need to end all 
the authorize processing instead of going on next module. Is it possible ?

------ users ------
DEFAULT Pool-Name := "default"
  Service-Type = Framed-User,
  Framed-Protocol = PPP,
  Framed-IP-Netmask = 255.255.255.254,
  Framed-MTU = 1492,
  Framed-Compression = Van-Jacobson-TCP-IP,
  Qos-Policy-Metering = DL128,
  Qos-Policy-Policing = UL64,
  Fall-Through = Yes

# Group processing

DEFAULT SQL-Group == "SUSPENDED", Auth-Type := Accept, \ 
Pool-Name := "disabled"

# If user if disabled, I want to end authorize process now

DEFAULT SQL-Group == "DSL500", Pool-Name := "dsl500"
  Qos-Policy-Metering := DL512,
  Qos-Policy-Policing := UL128,
  Fall-Through = Yes

# go on with sql and user specific attributes
-----

---- radiusd.conf ----
[...]
authorize {
  files
  chap
  sql
}
[...]
-----

> WARNING: Are you sure that you don't want to reject connections from
> suspended/non-existatnt users? All they have to do is set a static IP
> address from your pool on their end (it's ever so simple to force a
> static IP address in Connection Properties) and gain access.

I am not able to gain access by adding an IP address in connection properties. 
Connection is rejected by the BAS when an IP (in the pool or not) is 
requested. 

> It will work fine if you set the pool to override the IP address already
> set.
>
> 1. Leave the # Default profile for everyone in the users file
>
> 2. Make groups SUSPENDED, DSL500 etc. in groupcheck table. You need 2
> entries for group SUSPENDED, and one for others:
>
> (GroupName, Attribute, op, Value)
> SUSPENDED, Auth-Type, :=, Accept
> SUSPENDED, Pool-Name, :=, disabled
>
> DSL500, Pool-Name, :=, dsl500
>
> 3. Make groupreply entries:
>
> (GroupName, Attribute, op, Value)
> DSL500, Qos-Policy-Metering, :=, DL512
> DSL500, Qos-Policy-Policing, :=, UL128
>
> 4. Create user entries in radcheck table:
>
> (UserName, Attribute, op, Value) 
> testuser, Cleartext-Password, :=, test
>
> 5. Set static IP addresses and routes in radreply table:
>
> (UserName, Attribute, op, Value)
> testuser, Framed-IP-Address, :=, ...
> etc.
>
> 6. Connect users to groups in usergroup table
>
> If the user is suspended IP address from the "disabled" IP pool will
> override the static IP address from the radreply table. Without the
> correct IP address route won't work.

Thanks
-- 
David Majorel
Offratel/Lagoon ISP