<div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Hi again...<br></div>I'm starting taking some confuse idea with this...<br></div><br></div>I use 3 checkvals.<br><br></div>1 for Calling-Station-Id<br></div>
2 for Called-Station-Id<br></div>and 3 for Hints<br><br></div>and in the Hints file.. i setup my hints domains and filter to can apply for the suffix the correct acl/pool ip.<br><br></div><div>also have radiusHints and radiusFilterId in my OpenLDAP db.<br>
<br></div>now.. my question is.. why if Hints is not found in radius query... continue checking the rest for the values... and with any checkvals 1 or 2 works fine.. ??<br><br></div><div>so... if some user use other hints radius do access-accept... and not the reject like callings/called-station-id who with that... works fine..<br>
<br></div>simple debug.<br><br>[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=gtm478)<br>[ldap] expand: ou=institute,ou=users,dc=sld,dc=cu -> ou=institute,ou=users,dc=domain,dc=com<br> [ldap] ldap_get_conn: Checking Id: 0<br>
[ldap] ldap_get_conn: Got Id: 0<br> [ldap] performing search in ou=institute,ou=users,dc=domain,dc=com, with filter (uid=gtm478)<br> [ldap] performing search in cn=users.ppp,ou=profiles,ou=radius,ou=services,dc=domain,dc=com, with filter (objectclass=radiusprofile)<br>
[ldap] radiusCalledStationId -> Called-Station-Id == "999999"<br> [ldap] radiusCalledStationId -> Called-Station-Id == "888888"<br> [ldap] radiusCalledStationId -> Called-Station-Id == "111111"<br>
[ldap] extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 90000<br> [ldap] radiusIdleTimeout -> Idle-Timeout = 300<br> [ldap] radiusSessionTimeout -> Session-Timeout = 7200<br> [ldap] radiusFramedCompression -> Framed-Compression = Van-Jacobson-TCP-IP<br>
[ldap] radiusFramedMTU -> Framed-MTU = 576<br> [ldap] radiusFilterId -> Filter-Id = "<a href="http://general.in">general.in</a>"<br> [ldap] radiusFramedProtocol -> Framed-Protocol = PPP<br> [ldap] radiusServiceType -> Service-Type = Framed-User<br>
[ldap] Added User-Password = {CRYPT}$1$passwordcrypted in check items<br>[ldap] No default NMAS login sequence<br>[ldap] looking for check items in directory...<br> [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$cryptedpassword"<br>
[ldap] radiusCallingStationId -> Calling-Station-Id == "111111"<br>[ldap] looking for reply items in directory...<br>[ldap] user gtm478 authorized to use remote access<br> [ldap] ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>rlm_checkval: Item Name: Calling-Station-Id, Value: 111111<br>rlm_checkval: Value Name: Calling-Station-Id, Value: 111111<br>++[checkval1] returns ok<br>rlm_checkval: Item Name: Called-Station-Id, Value: 88888<br>
rlm_checkval: Value Name: Called-Station-Id, Value: 999999<br>rlm_checkval: Value Name: Called-Station-Id, Value: 88888<br>++[checkval2] returns ok<br>rlm_checkval: Item Name: Hint, Value: userdefault<br><b>rlm_checkval: Could not find attribute named Hint in check pairs</b><br>
<b>++[checkval3] returns notfound</b><br><br><b>I need to stop here.. and reject the user.. </b><br><br>++? if (User-Name =~ /^(.+)@<a href="http://institute.domain.com/">institute.domain.com/</a>)<br>? Evaluating (User-Name =~ /^(.+)@<a href="http://institute.domain.com/">institute.domain.com/</a>) -> TRUE<br>
++? if (User-Name =~ /^(.+)@<a href="http://institute.domain.com/">institute.domain.com/</a>) -> TRUE<br>++- entering if (User-Name =~ /^(.+)@<a href="http://institute.domain.com/">institute.domain.com/</a>) {...}<br>
rlm_sqlcounter: Entering module authorize code<br>
<br></div><b>NOT should be continue.....</b><br><div><br></div><div>the users .. logging on...ok. (with bad hints)<br></div><div>with hints works fine.<br clear="all"></div><div><div><div><div><div><div><div><div><div><div>
<div><div><div><br></div><div>thanxs in advance... (i'm continue searching and try meanwhilte wait for this...)<br></div><div>sorry for my bad english .. O:-)<br></div><div>regards.<br><br></div><div>-- <br><font color="#888888"><font color="#888888">Antonio Pe</font><span><font color="#888888">ñ</font></span><font color="#888888">a</font><span></span><br>
<font color="#888888">Secure email with PGP 0x8B021001 available at <a href="http://pgp.mit.edu" target="_blank">http://pgp.mit.edu</a><br></font></font><font color="#888888">
<font color="#888888">Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001</font></font>
</div></div></div></div></div></div></div></div></div></div></div></div></div></div>