<div dir="ltr"><div><div><div>hi again.... <br></div>now is fine.. the hint query was ... <br><br></div>1 configuration in the hints file.. left the default for users not with suffix.. and ldap.atrribmap.. miss Hint --- radiusHint<br>
<br></div>again.. thanxs for all<br><br><div><div><div><div></div></div></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/3/22 Tony Peña <span dir="ltr"><<a href="mailto:emperor.cu@gmail.com" target="_blank">emperor.cu@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Hi again...<br></div>I'm starting taking some confuse idea with this...<br>
</div><br></div>I use 3 checkvals.<br><br></div>1 for Calling-Station-Id<br></div>
2 for Called-Station-Id<br></div>and 3 for Hints<br><br></div>and in the Hints file.. i setup my hints domains and filter to can apply for the suffix the correct acl/pool ip.<br><br></div><div>also have radiusHints and radiusFilterId in my OpenLDAP db.<br>
<br></div>now.. my question is.. why if Hints is not found in radius query... continue checking the rest for the values... and with any checkvals 1 or 2 works fine.. ??<br><br></div><div>so... if some user use other hints radius do access-accept... and not the reject like callings/called-station-id who with that... works fine..<br>
<br></div>simple debug.<br><br>[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=gtm478)<br>[ldap] expand: ou=institute,ou=users,dc=sld,dc=cu -> ou=institute,ou=users,dc=domain,dc=com<br> [ldap] ldap_get_conn: Checking Id: 0<br>
[ldap] ldap_get_conn: Got Id: 0<br> [ldap] performing search in ou=institute,ou=users,dc=domain,dc=com, with filter (uid=gtm478)<br> [ldap] performing search in cn=users.ppp,ou=profiles,ou=radius,ou=services,dc=domain,dc=com, with filter (objectclass=radiusprofile)<br>
[ldap] radiusCalledStationId -> Called-Station-Id == "999999"<br> [ldap] radiusCalledStationId -> Called-Station-Id == "888888"<br> [ldap] radiusCalledStationId -> Called-Station-Id == "111111"<br>
[ldap] extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 90000<br> [ldap] radiusIdleTimeout -> Idle-Timeout = 300<br> [ldap] radiusSessionTimeout -> Session-Timeout = 7200<br> [ldap] radiusFramedCompression -> Framed-Compression = Van-Jacobson-TCP-IP<br>
[ldap] radiusFramedMTU -> Framed-MTU = 576<br> [ldap] radiusFilterId -> Filter-Id = "<a href="http://general.in" target="_blank">general.in</a>"<br> [ldap] radiusFramedProtocol -> Framed-Protocol = PPP<br>
[ldap] radiusServiceType -> Service-Type = Framed-User<br>
[ldap] Added User-Password = {CRYPT}$1$passwordcrypted in check items<br>[ldap] No default NMAS login sequence<br>[ldap] looking for check items in directory...<br> [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$cryptedpassword"<br>
[ldap] radiusCallingStationId -> Calling-Station-Id == "111111"<br>[ldap] looking for reply items in directory...<br>[ldap] user gtm478 authorized to use remote access<br> [ldap] ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>rlm_checkval: Item Name: Calling-Station-Id, Value: 111111<br>rlm_checkval: Value Name: Calling-Station-Id, Value: 111111<br>++[checkval1] returns ok<br>rlm_checkval: Item Name: Called-Station-Id, Value: 88888<br>
rlm_checkval: Value Name: Called-Station-Id, Value: 999999<br>rlm_checkval: Value Name: Called-Station-Id, Value: 88888<br>++[checkval2] returns ok<br>rlm_checkval: Item Name: Hint, Value: userdefault<br><b>rlm_checkval: Could not find attribute named Hint in check pairs</b><br>
<b>++[checkval3] returns notfound</b><br><br><b>I need to stop here.. and reject the user.. </b><br><br>++? if (User-Name =~ /^(.+)@<a href="http://institute.domain.com/" target="_blank">institute.domain.com/</a>)<br>? Evaluating (User-Name =~ /^(.+)@<a href="http://institute.domain.com/" target="_blank">institute.domain.com/</a>) -> TRUE<br>
++? if (User-Name =~ /^(.+)@<a href="http://institute.domain.com/" target="_blank">institute.domain.com/</a>) -> TRUE<br>++- entering if (User-Name =~ /^(.+)@<a href="http://institute.domain.com/" target="_blank">institute.domain.com/</a>) {...}<br>
rlm_sqlcounter: Entering module authorize code<br>
<br></div><b>NOT should be continue.....</b><br><div><br></div><div>the users .. logging on...ok. (with bad hints)<br></div><div>with hints works fine.<br clear="all"></div><div><div><div><div><div><div><div><div><div><div>
<div><div><div><br></div><div>thanxs in advance... (i'm continue searching and try meanwhilte wait for this...)<br></div><div>sorry for my bad english .. O:-)<br></div><div>regards.<span class="HOEnZb"><font color="#888888"><br>
<br></font></span></div><span class="HOEnZb"><font color="#888888"><div>-- <br><font color="#888888"><font color="#888888">Antonio Pe</font><span><font color="#888888">ñ</font></span><font color="#888888">a</font><span></span><br>
<font color="#888888">Secure email with PGP 0x8B021001 available at <a href="http://pgp.mit.edu" target="_blank">http://pgp.mit.edu</a><br></font></font><font color="#888888">
<font color="#888888">Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001</font></font>
</div></font></span></div></div></div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div><br><br clear="all"><br>-- <br><font color="#888888"><font color="#888888">Antonio Pe</font><span><font color="#888888">ñ</font></span><font color="#888888">a</font><span></span><br><font color="#888888">Secure email with PGP 0x8B021001 available at <a href="http://pgp.mit.edu" target="_blank">http://pgp.mit.edu</a><br>
</font></font><font color="#888888">
<font color="#888888">Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001</font></font>
</div>