Default behavior for users not in any group

[Maxim S. Denisov]

Hello.

12.10.2010, в 13:54, Alan Buxey написал(а):

>> I have freeradius 2.1.6 with rlm_sql_oracle. There is a plenty of users in radcheck table and several of them are a members of a group. As stated in comments in the dialup.conf all other users are a members of the group DEFAULT if I understood it right. I put the fields DEFAULT Auth-Type := Reject in the radgroupcheck table but it seems that radius doesn't process the group checks if there is no explict group record for the user in radusergroup table even if I set read_groups. The radius accepts the requests if the username and password matches.
>> How can I reject users not stated in the group without explictly assigning them to the DEFAULT group in radusergroup?
> 
> if you run briefly in full debug mode - ie 'radiusd -X' and then spend some time
> with a coffee or herbal tea or Jolt..or whatever - you can read exactly what the
> server is doing...you can watch and disect its logic and see exactly why
> its not doing what you want.  then you can change it :-)

I have alredy checked the debug output and saw that radiusd doesn't check radgroupckeck table if the username is not associated with any group in radusergroup. I have the record DEFAULT Auth-Type := Reject in the radgroupreply table and if I explictly associate the user with the DEFAULT group i getting the reject. This is the output of the radiusd -X -f:

++[auth_log] returns ok
++[chap] returns noop
++[mschap] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
[sql] 	expand: %{Stripped-User-Name} -> 
[sql] 	expand: %{User-Name} -> 1001
[sql] 	expand: %{%{User-Name}:-DEFAULT} -> 1001
[sql] 	expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 1001
[sql] sql_set_user escaped user --> '1001'
rlm_sql (sql): Reserving sql socket id: 3
[sql] 	expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '1001' ORDER BY id
SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '1001' ORDER BY id
[sql] User found in radcheck table
[sql] 	expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '1001' ORDER BY id
SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '1001' ORDER BY id
[sql] 	expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM radusergroup WHERE UserName='1001'
SELECT GroupName FROM radusergroup WHERE UserName='1001'
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
+- entering group PAP {...}
[pap] login attempt with password "temp"
[pap] Using clear text password "temp"
[pap] User authenticated successfully
++[pap] returns ok
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 62 to 10.0.0.1 port 1025

How can I reject the users not listed in any group?