<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2900.2995" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=fr dir=ltr align=left><FONT face=Tahoma
size=2>-----Message d'origine-----<BR><B>De :</B>
freeradius-users-bounces+thibault.lemeur=supelec.fr@lists.freeradius.org
[mailto:freeradius-users-bounces+thibault.lemeur=supelec.fr@lists.freeradius.org]
<B>De la part de</B> Marco Stuhl<BR><B>Envoyé :</B> vendredi 15 décembre
2006 13:47<BR><B>À :</B> FreeRadius users mailing
list<BR><B>Objet :</B> Re: RE : RE : rlm_sql: Password in Accounting
Packet<BR><BR></FONT></DIV>
<DIV>Here's the scenario.<BR><BR>I'd like to make one username for all users
having/sharing same service (e.g. users w/ service A all have username 'foo'
with unique password for every user). Now, the problem arises with accounting,
or, to be more precise, session reports that will be available for them to see
and check their past sessions. <SPAN class=586250913-15122006><FONT
face=Arial color=#0000ff size=2> </FONT></SPAN></DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff size=2>So
the password can only be retreived for the Access-Request packet: use the
postauth query to record it, then use radacct to record accoutning
informations.</FONT></SPAN></DIV><FONT face=Arial color=#0000ff size=2></FONT>
<DIV><FONT face=Arial color=#0000ff size=2></FONT><FONT face=Arial
color=#0000ff size=2></FONT><BR>Since accounting (SQL schema) is based on
unique username, I cannot make the distinction between users. Also, I've noted
(in past FR versions, though) that it was possible for log files, since FR
logged passwords there? <SPAN class=586250913-15122006><FONT face=Arial
color=#0000ff size=2> </FONT></SPAN></DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff
size=2>Accounting is based on AcctSessionId (or AcctUniqueId, which can
be computed by a FR module). AFAIK, there is no assumption about the
'unique username' thing: it is your session analyzer that makes such
assumption.</FONT></SPAN></DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff size=2>If
you want to differentiate users, you'll have to find rules that help map
attributes recorded in the radacct table with attributes recorded in the
postauth table: then a simple Join can help recover the true
username.</FONT></SPAN><SPAN class=586250913-15122006> </SPAN><BR><SPAN
class=586250913-15122006><FONT face=Arial color=#0000ff
size=2> </FONT></SPAN></DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff
size=2>HTH,</FONT></SPAN></DIV>
<DIV><SPAN class=586250913-15122006><FONT face=Arial color=#0000ff
size=2>Thibault</FONT></SPAN></DIV></BLOCKQUOTE></BODY></HTML>