<div>I have a user called "test150" that belongs to group "testgroup123". Bellow you can see what I have in my database related to "test150" user and "testgroup123" group:</div><div>
<br></div><div><div>select * from radcheck where username = 'test150';</div><div><br></div><div> id | username | attribute |op | value </div><div>--------------+---------------+-----------------------------+----+---------</div>
<div> 1523812 | test150 | Cleartext-Password | := | test150</div><div><br></div><div><br></div><div><div>select * from radgroupcheck where groupname = 'testgroup123';</div><div><br></div><div> id | groupname | attribute | op | value </div>
<div>----+--------------------+----------------------------------------+----+----------</div><div> 11 | testgroup123 | NAS-IP-Address | := | 10.3.1.1</div><div> 15 | testgroup123 | CarboSolutions-Max-Users | < | 5</div>
</div><div><br></div><div> CarboSolutions-Max-Users is an attribute declared of myself.</div><div><br></div><div><br></div><div><div>select * from radusergroup where username = 'test150';</div><div><br></div><div>
username | groupname | priority </div><div>---------------+--------------------+----------</div><div> test150 | testgroup123 | 0</div></div><div><br></div></div><div><div>select * from radgroupreply where groupname = 'testgroup123';</div>
<div><br></div><div> id | groupname | attribute | op | value </div><div>-----+--------------------+------------------------------------------+----+--------</div><div> 14 | testgroup123 | WISPr-Bandwidth-Max-Down | := | 256000</div>
</div><div><br></div><div><b>The problem:</b></div><div><b><br></b></div><div>When I try to log in with "test150" and CarboSolutions-Max-Users attribute is < 5, the bandwidth limitation is working (in debug output I can see that FR sends WISPr-Bandwidth-Max-Down attribute in reply - and it applies). But when CarboSolutions-Max-Users check isn't fulfilled (I mean is greater or equal to 5) WISPr-Bandwidth-Max-Down attribute isn't shown in FR debug output as reply attrtibute - and not working bandwidth limitation. </div>
<div><br></div><div><b>N.B.1 </b>I set the CarboSolutions-Max-Users attribute in default site's file in authorize section. Looks like this:</div><div><br></div><div><div>update request {</div><div><br></div><div> CarboSolutions-Max-Users="%{sql:SELECT COUNT(DISTINCT radacct.UserName) FROM radacct INNER JOIN radusergroup ON radusergroup.UserName = radacct.UserName WHERE radusergroup.GroupName = (SELECT GroupName FROM radusergroup ...}"</div>
<div><br></div><div>}</div></div><div><br></div><div>I understand that when group's check conditions aren't meet, I can login neglecting the group's attributes. Can anybody tell me how to avoid that behavior? I think that if a user belongs to a group and the checks for the group aren't meet, the user shoudn't be able to be authenticated. Am I wrong? If not, what's the problem to my issue?</div>
<div><br></div><div><b>N.B.2 </b>The output from running FR with -XXX switch is (when it is not working well):</div><div><br></div><div><div>rad_recv: Access-Request packet from host 127.0.0.1 port 34173, id=225, length=276</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>ChilliSpot-Version = "1.2.9"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test150"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "test150"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Service-Type = Login-User</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Acct-Session-Id = "501a75b300000001"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Framed-IP-Address = 10.3.1.3</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Type = Wireless-802.11</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Id = "00000001"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Calling-Station-Id = "00-25-22-83-95-C5"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Called-Station-Id = "F8-D1-11-05-93-01"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 10.3.1.1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Identifier = "nas-1"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>WISPr-Location-ID = "isocc=,cc=,ac=,network=netNFork,"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>WISPr-Location-Name = "netNFork_LAN"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>WISPr-Logoff-URL = "<a href="http://10.3.1.1:3001/logoff">http://10.3.1.1:3001/logoff</a>"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x0c4075cf2f111445caff3fb367ddd776</div><div>Thu Aug 2 15:43:44 2012 : Info: # Executing section authorize from file /netnfork/radius//etc/raddb/sites-enabled/default</div>
<div>Thu Aug 2 15:43:44 2012 : Info: +- entering group authorize {...}</div><div>Thu Aug 2 15:43:44 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %S -> 2012-08-02 15:43:44</div><div>
Thu Aug 2 15:43:44 2012 : Info: sql_xlat</div><div>Thu Aug 2 15:43:44 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> test150</div><div>Thu Aug 2 15:43:44 2012 : Info: sql_set_user escaped user --> 'test150'</div>
<div>Thu Aug 2 15:43:44 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT COUNT(DISTINCT CallingStationId) FROM radacct WHERE UserName='%{User-Name}' AND CallingStationId != '%{Calling-Station-Id}' -> SELECT COUNT(DISTINCT CallingStationId) FROM radacct WHERE UserName='test150' AND CallingStationId != '00-25-22-83-95-C5'</div>
<div>Thu Aug 2 15:43:44 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 30</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 1</div>
<div>Thu Aug 2 15:43:45 2012 : Info: sql_xlat finished</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Released sql socket id: 30</div><div>Thu Aug 2 15:43:45 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{sql:SELECT COUNT(DISTINCT CallingStationId) FROM radacct WHERE UserName='%{User-Name}' AND CallingStationId != '%{Calling-Station-Id}'} -> 0</div>
<div>Thu Aug 2 15:43:45 2012 : Info: sql_xlat</div><div>Thu Aug 2 15:43:45 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> test150</div><div>Thu Aug 2 15:43:45 2012 : Info: sql_set_user escaped user --> 'test150'</div>
<div><br></div><div><font color="#ff0000">//*** this interests (bellow)--></font></div><div><br></div><div>Thu Aug 2 15:43:45 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT COUNT(DISTINCT radacct.UserName) FROM radacct INNER JOIN radusergroup ON radusergroup.UserName = radacct.UserName WHERE radusergroup.GroupName = (SELECT GroupName FROM radusergroup WHERE UserName='%{User-Name}') AND AcctStopTime ISNULL -> SELECT COUNT(DISTINCT radacct.UserName) FROM radacct INNER JOIN radusergroup ON radusergroup.UserName = radacct.UserName WHERE radusergroup.GroupName = (SELECT GroupName FROM radusergroup WHERE UserName='test150') AND AcctStopTime ISNULL</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 29</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 1</div>
<div>Thu Aug 2 15:43:45 2012 : Info: sql_xlat finished</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Released sql socket id: 29</div><div>Thu Aug 2 15:43:45 2012 : Info: <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{sql:SELECT COUNT(DISTINCT radacct.UserName) FROM radacct INNER JOIN radusergroup ON radusergroup.UserName = radacct.UserName WHERE radusergroup.GroupName = (SELECT GroupName FROM radusergroup WHERE UserName='%{User-Name}') AND AcctStopTime ISNULL} -> 1</div>
<div>Thu Aug 2 15:43:45 2012 : Info: ++[request] returns notfound</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> test150</div><div>
Thu Aug 2 15:43:45 2012 : Info: [sql] sql_set_user escaped user --> 'test150'</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 28</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'test150' ORDER BY id</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 5</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] User found in radcheck table</div>
<div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'test150' ORDER BY id</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 5</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='test150' ORDER BY priority</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 1</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'testgroup123' ORDER BY id</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 2 , fields = 5</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Released sql socket id: 28</div>
<div>Thu Aug 2 15:43:45 2012 : Info: ++[sql] returns ok</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[expiration] returns noop</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[logintime] returns noop</div><div>Thu Aug 2 15:43:45 2012 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local'</div>
<div>Thu Aug 2 15:43:45 2012 : Info: WARNING: Use the PAP or CHAP modules instead.</div><div>Thu Aug 2 15:43:45 2012 : Info: User-Password in the request is correct.</div><div>Thu Aug 2 15:43:45 2012 : Info: # Executing section post-auth from file /netnfork/radius//etc/raddb/sites-enabled/default</div>
<div>Thu Aug 2 15:43:45 2012 : Info: +- entering group post-auth {...}</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[exec] returns noop</div><div>Sending Access-Accept of id 225 to 127.0.0.1 port 34173</div><div>Thu Aug 2 15:43:45 2012 : Info: Finished request 14.</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: Going to the next request</div><div>Thu Aug 2 15:43:45 2012 : Debug: Waking up in 2.9 seconds.</div><div><br></div><div><font color="#ff0000">//*** bellow is the accounting log, I think it shouldn't present interest</font></div>
<div><br></div><div>rad_recv: Accounting-Request packet from host 127.0.0.1 port 41985, id=8, length=223</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ChilliSpot-Version = "1.2.9"</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>ChilliSpot-Attr-10 = 0x00000002</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Event-Timestamp = "Aug 2 2012 15:43:44 EEST"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test150"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Acct-Status-Type = Start</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Acct-Session-Id = "501a75b300000001"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Framed-IP-Address = 10.3.1.3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Type = Wireless-802.11</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 1</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Id = "00000001"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Calling-Station-Id = "00-25-22-83-95-C5"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Called-Station-Id = "F8-D1-11-05-93-01"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 10.3.1.1</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Identifier = "nas-1"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>WISPr-Location-ID = "isocc=,cc=,ac=,network=netNFork,"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>WISPr-Location-Name = "netNFork_LAN"</div><div>Thu Aug 2 15:43:45 2012 : Info: # Executing section preacct from file /netnfork/radius//etc/raddb/sites-enabled/default</div>
<div>Thu Aug 2 15:43:45 2012 : Info: +- entering group preacct {...}</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[preprocess] returns ok</div><div>Thu Aug 2 15:43:45 2012 : Info: [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 10.3.1.1,Acct-Session-Id = "501a75b300000001",User-Name = "test150"'</div>
<div>Thu Aug 2 15:43:45 2012 : Info: [acct_unique] Acct-Unique-Session-ID = "84a01adb8bcce762".</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[acct_unique] returns ok</div><div>Thu Aug 2 15:43:45 2012 : Info: [suffix] No '@' in User-Name = "test150", looking up realm NULL</div>
<div>Thu Aug 2 15:43:45 2012 : Info: [suffix] No such realm "NULL"</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[suffix] returns noop</div><div>Thu Aug 2 15:43:45 2012 : Info: # Executing section accounting from file /netnfork/radius//etc/raddb/sites-enabled/default</div>
<div>Thu Aug 2 15:43:45 2012 : Info: +- entering group accounting {...}</div><div>Thu Aug 2 15:43:45 2012 : Info: [detail] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Packet-Src-IP-Address} -> 127.0.0.1</div>
<div>Thu Aug 2 15:43:45 2012 : Info: [detail] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: /netnfork/radius//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /netnfork/radius//var/log/radius/radacct/<a href="http://127.0.0.1/detail-20120802">127.0.0.1/detail-20120802</a></div>
<div>Thu Aug 2 15:43:45 2012 : Info: [detail] /netnfork/radius//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /netnfork/radius//var/log/radius/radacct/<a href="http://127.0.0.1/detail-20120802">127.0.0.1/detail-20120802</a></div>
<div>Thu Aug 2 15:43:45 2012 : Info: [detail] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %t -> Thu Aug 2 15:43:45 2012</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[detail] returns ok</div><div>
Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> test150</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] sql_set_user escaped user --> 'test150'</div>
<div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{NAS-Port} -> 1</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Acct-Delay-Time} -> </div>
<div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>... expanding second conditional</div><div>Thu Aug 2 15:43:45 2012 : Info: [sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, </div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 27</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK</div><div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql_postgresql: query affected rows = 1</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: rlm_sql (sql): Released sql socket id: 27</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[sql] returns ok</div><div>Thu Aug 2 15:43:45 2012 : Info: [attr_filter.accounting_response] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> test150</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: attr_filter: Matched entry DEFAULT at line 12</div><div>Thu Aug 2 15:43:45 2012 : Info: ++[attr_filter.accounting_response] returns updated</div><div>Sending Accounting-Response of id 8 to 127.0.0.1 port 41985</div>
<div>Thu Aug 2 15:43:45 2012 : Info: Finished request 15.</div><div>Thu Aug 2 15:43:45 2012 : Info: Cleaning up request 15 ID 8 with timestamp +1230</div><div>Thu Aug 2 15:43:45 2012 : Debug: Going to the next request</div>
<div>Thu Aug 2 15:43:45 2012 : Debug: Waking up in 2.9 seconds.</div><div>Thu Aug 2 15:43:48 2012 : Info: Cleaning up request 14 ID 225 with timestamp +1229</div><div>Thu Aug 2 15:43:48 2012 : Info: Ready to process requests.</div>
</div><div><br></div><div><br></div><div><br></div>