<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>hey thanks! it's working now. it was because the op in radcheck is "==" which is the default from the schema. I changed it to ":=" and it is working now. :)<br></span></div><div><br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><font face="Arial" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Fajar A. Nugraha <list@fajar.net><br><b><span style="font-weight: bold;">To:</span></b> FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br><b><span style="font-weight: bold;">Sent:</span></b> Tuesday, September 6, 2011 1:28 PM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: Expiration Module Not Returning the Error
Message<br></font><br>On Tue, Sep 6, 2011 at 11:41 AM, Det Det <<a ymailto="mailto:det.explorer@yahoo.com" href="mailto:det.explorer@yahoo.com">det.explorer@yahoo.com</a>> wrote:<br>> Hi,<br>> The expiration module works but it is not returning the error message.<br>> Everytime I include the Expiration attribute and set date accordingly. The<br>> user is denied login. The reason is because the account expired and NOT<br>> because there is "no known good password found" as shown below. How to tell<br>> RADIUS to stop processing anything after expiration check? I suspect it<br>> proceeds the rest of the checks and so the error message has been<br>> overwritten by other modules' error message.<br>><br>><br>> +++[sql2] returns ok<br>> ++- redundant-load-balance group redundant_load_balance_sql returns ok<br>> ++[expiration] returns noop<br>> ++[logintime] returns noop<br>> [pap] WARNING! No "known good"
password found for the user. Authentication<br>> may fail because of this.<br>> ++[pap] returns noop<br><br>Works for me. From modules/expiration: "It should be included in the<br>*end* of the authorize section in order to handle user Expiration" (or<br>just uncomment expiration line in sites-available/default). The debug<br>log should show something like this<br><br>[expiration] Checking Expiration time: '2011 Sep 6 03:00:00'<br>[expiration] Account has expired<br>[expiration] expand: Password Has Expired -> Password Has Expired<br>++[expiration] returns userlock<br>Invalid user (Account has expired [Expiration 2011 Sep 6 03:00:00]):<br>[testuser] (from client localhost port 0)<br>Using Post-Auth-Type Reject<br># Executing group from file /etc/freeradius/sites-enabled/default<br>+- entering group REJECT {...}<br>[attr_filter.access_reject] expand: %{User-Name} -> testuser<br> attr_filter:
Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>Sending Access-Reject of id 242 to 127.0.0.1 port 52990<br> Reply-Message += "Password Has Expired\r\n"<br><br>If it doesn't, then either:<br>- you're using an old FR version with some bugs regarding expiration<br>on it, in which case you should upgrade, or<br>- you didn't list expiration in authorize section, or<br>- you didn't have Expiration attribute for your user (in users<br>file/sql/whatever)<br><br>-- <br>Fajar<br><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br><br><br></div></div></div></body></html>