<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="Open WebMail 2.32 20040525" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2">I did not usurp a thread, I reposted my own.
<br />
<br />I changed radcheck to have := instead of ==. No change.
<br />
<br />First query returns:
<br />+----+--------------+--------------+-------------+----+
<br />| id | GroupName | Attribute | Value | op |
<br />+----+--------------+--------------+-------------+----+
<br />| 28 | MS1-AP1 | Service-Type | Framed-User | == |
<br />| 31 | Router-Admin | Service-Type | Login-User | == |
<br />+----+--------------+--------------+-------------+----+
<br />Second query returns +----+--------------+----------------+-------+----+
<br />| id | GroupName | Attribute | Value | op |
<br />+----+--------------+----------------+-------+----+
<br />| 34 | Router-Admin | Mikrotik-Group | full | = |
<br />| 39 | Router-Admin | Fall-Through | Yes | = |
<br />| 37 | MS1-AP1 | Fall-Through | Yes | = |
<br />| 33 | MS1-AP1 | Port-Limit | 128k | = |
<br />+----+--------------+----------------+-------+----+
<br />
<br />I have a document from the FreeRadius WIKI (rlm_sql) that says, "Processing continues to the next group IF:
<br /> There was not a match for the last group's check items OR
<br /> Fall-Through was set in the last group's reply items.
<br />If the user logs into a router, the request is for Login-User and they should get the Router-Admin replies. If they log in to an AP, the request is Framed-User and they should get the AP replies.
<br />
<br />
<br />Scott Reed
<br />
Owner
<br />
NewWays
<br />
Wireless Networking
<br />
Network Design, Installation and Administration
<br />
<a target="_blank" href="http://www.nwwnet.net/">www.nwwnet.net</a>
<br />
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: Phil Mayers <p.mayers@imperial.ac.uk>
<br />
To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org>
<br />
Sent: Thu, 06 Apr 2006 13:22:39 +0100
<br />
Subject: Re: User in Multiple Groups
<br />
<br />> Scott Reed wrote:
<br />>
> I have searched the archive and came close to figuring this out, but I have
not
<br />>
<br />>
Don't start your query as part of another thread please.
<br />>
<br />>
>
<br />>
> Configuration tables:
<br />>
> 1 USERGROUP
<br />>
> 2 80 sreed MS1-AP1
<br />>
> 3 76 treed MS1-AP1
<br />>
> 4 78 sreed Router-Admin
<br />>
> 5 79 treed Router-Admin
<br />>
> 6 81 dreed Router-Admin
<br />>
> 7
<br />>
> 8 RADCHECK
<br />>
> 9 331 dreed User-Password
== password
<br />>
> 10 269 treed User-Password
== password
<br />>
> 11 267 sreed User-Password
== password
<br />>
<br />>
This should be ":=" for User-Password. If the match is failing, that
may
<br />>
be the issue.
<br />>
<br />>
> 12
<br />>
> 13 RADGROUPCHECK
<br />>
> 14 31 Router-Admin
Service-Type == Login-User
<br />>
> 15 28 MS1-AP1
Service-Type == Framed-User
<br />>
> 16
<br />>
> 17 RADREPLY
<br />>
> 18 33 sreed Fall-Through
= yes
<br />>
> 19 43 treed Fall-Through
= yes
<br />>
> 20
<br />>
> 21 RADGROUPREPLY
<br />>
> 22 33 MS1-AP1
Port-Limit = 128k
15
<br />>
> 23 34 Router-Admin
Mikrotik-Group = full 10
<br />>
> 24 39 Router-Admin
Fall-Through = Yes 10
<br />>
> 25 37 MS1-AP1
Fall-Through = Yes 15
<br />>
<br />>
I don't think Fall-Through does anything in rlm_sql. What are you
<br />>
expecting it to do?
<br />>
<br />>
> rad_recv: Access-Request packet from host 192.168.100.13:1201, id=166,
length=83
<br />>
> Service-Type = Login-User
<br />>
> User-Name = "treed"
<br />>
> User-Password = "password"
<br />>
> Calling-Station-Id =
"192.168.100.240"
<br />>
> NAS-Identifier = "HotSpot"
<br />>
> NAS-IP-Address = 192.168.100.13
<br />>
> Processing the authorize section of radiusd.conf
<br />>
> modcall: entering group authorize for request 1
<br />>
> modcall[authorize]: module "preprocess" returns ok for
request 1
<br />>
> modcall[authorize]: module "chap" returns noop for request
1
<br />>
> modcall[authorize]: module "mschap" returns noop for
request 1
<br />>
> rlm_realm: No '@' in User-Name = "treed", looking
up realm NULL
<br />>
> rlm_realm: No such realm "NULL"
<br />>
> modcall[authorize]: module "suffix" returns noop for
request 1
<br />>
> radius_xlat: 'treed'
<br />>
> rlm_sql (sql): sql_set_user escaped user --> 'treed'
<br />>
> rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM
radcheck WHERE
<br />>
> Username = 'treed' ORDER BY id
<br />>
> rlm_sql_mysql: query: SELECT
<br />>
>
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op
<br />>
> FROM radgroupcheck,usergroup WHERE usergroup.Username = 'treed' AND
<br />>
> usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
<br />>
<br />>
What is the result of this query if you execute it directly against the
<br />>
database?
<br />>
<br />>
> rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM
radreply WHERE
<br />>
> Username = 'treed' ORDER BY id
<br />>
<br />>
> rlm_sql_mysql: query: SELECT
<br />>
>
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op
<br />>
> FROM radgroupreply,usergroup WHERE usergroup.Username = 'treed' AND
<br />>
> usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.prio
<br />>
<br />>
Again, what does this query give against the database?
<br />>
<br />>
> rlm_sql (sql): No matching entry in the database for request from user
[treed]
<br />>
<br />>
This error code is returned if the check items don't match the request.
<br />>
<br />>
Possibly take a look in:
<br />>
<br />>
src/modules/rlm_sql/rlm_sql.c
<br />>
<br />>
...around line 860 (depending on the version you're running) and
<br />>
uncomment these lines:
<br />>
<br />>
/*
<br />>
* Uncomment these lines for debugging
<br />>
* Recompile, and run 'radiusd -X'
<br />>
*/
<br />>
<br />>
/*
<br />>
DEBUG2("rlm_sql: check items");
<br />>
vp_listdebug(check_tmp);
<br />>
DEBUG2("rlm_sql: reply items");
<br />>
vp_listdebug(reply_tmp);
<br />>
*/
<br />>
<br />>
...then recompile and run again.
<br />>
-
<br />>
List info/subscribe/unsubscribe? See <a target="_blank" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
<br /><b>------- End
of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>