<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello!<br>
<br>
I'm trying to use dailycounter on a LDAP authenticated user and it
doesn't seem to work. I think I did all steps correctly, but then
again, i have been wrong before:)<br>
<br>
In radcheck table I added:<br>
testuser Max-Daily-Session := 600<br>
<br>
I enabled dailycounter in counters.conf:<br>
sqlcounter dailycounter {<br>
counter-name = Daily-Session-Time<br>
check-name = Max-Daily-Session<br>
reply-name = Session-Timeout<br>
sqlmod-inst = sql<br>
key = User-Name<br>
reset = daily<br>
query = "SELECT SUM(`Acct-Session-Time` - \<br>
GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)),
0)) \<br>
FROM accounting WHERE `User-Name` = '%{${key}}' AND
\<br>
UNIX_TIMESTAMP(`Acct-Start-Time`) +
`Acct-Session-Time` > '%b'"<br>
}<br>
<br>
In sites-available/default I have the following:<br>
authorize {<br>
if (User-Password) {<br>
update control {<br>
Auth-Type := ldap<br>
Ldap-UserDN :=
"eduPersonPrincipalName=%{User-Name},dc=example,dc=com"<br>
<br>
}<br>
}<br>
sql<br>
dailycounter<br>
}<br>
authenticate {<br>
Auth-Type LDAP {<br>
ldap<br>
}<br>
}<br>
<br>
Debug output:<br>
rad_recv: Access-Request packet from host 10.10.10.10 port 33651,
id=75, length=202<br>
NAS-Port-Type = Wireless-802.11<br>
Calling-Station-Id = "00:24:D7:47:1C:XX"<br>
Called-Station-Id = "hs-kit-testing"<br>
NAS-Port-Id = "bridge-bralci"<br>
User-Name = "testuser"<br>
NAS-Port = 2151677975<br>
Acct-Session-Id = "80400017"<br>
Framed-IP-Address = 192.168.81.198<br>
Mikrotik-Host-IP = 192.168.81.198<br>
User-Password = "password"<br>
Service-Type = Login-User<br>
WISPr-Logoff-URL = <a class="moz-txt-link-rfc2396E" href="http://192.168.81.1">"http://192.168.81.1"</a><br>
NAS-Identifier = "kit-testing"<br>
NAS-IP-Address = 192.168.1.116<br>
# Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
+- entering group authorize {...}<br>
++? if (User-Password)<br>
? Evaluating (User-Password) -> TRUE<br>
++? if (User-Password) -> TRUE<br>
++- entering if (User-Password) {...}<br>
expand:
eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi ->
eduPersonPrincipalName=testuser,dc=example,dc=com<br>
+++[control] returns notfound<br>
++- if (User-Password) returns notfound<br>
[sql] expand: %{User-Name} -> testuser<br>
[sql] sql_set_user escaped user --> 'testuser'<br>
rlm_sql (sql): Reserving sql socket id: 2<br>
[sql] expand: SELECT id, username, attribute, value, op
FROM radcheck WHERE username =
'%{SQL-User-Name}' ORDER BY id -> SELECT id, username,
attribute, value, op FROM radcheck WHERE
username = 'testuser' ORDER BY id<br>
rlm_sql_mysql: query: SELECT id, username, attribute, value,
op FROM radcheck WHERE username =
'testuser' ORDER BY id<br>
[sql] expand: SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}'
ORDER BY priority -> SELECT groupname FROM
radusergroup WHERE username = 'testuser' ORDER
BY priority<br>
rlm_sql_mysql: query: SELECT groupname FROM
radusergroup WHERE username = 'testuser' ORDER
BY priority<br>
rlm_sql (sql): Released sql socket id: 2<br>
[sql] User testuser not found<br>
++[sql] returns notfound<br>
<b>rlm_sqlcounter: Entering module authorize code</b><b><br>
</b><b>rlm_sqlcounter: Could not find Check item value pair</b><b><br>
</b><b>++[dailycounter] returns noop</b><br>
Found Auth-Type = LDAP<br>
# Executing group from file /etc/raddb/sites-enabled/default<br>
+- entering group LDAP {...}<br>
[ldap] login attempt by "testuser" with password "password"<br>
[ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com<br>
[ldap] (re)connect to ldaps.example.com:636, authentication 1<br>
[ldap] setting TLS mode to 1<br>
[ldap] bind as
eduPersonPrincipalName=testuser,dc=example,dc=com/password to
ldaps.example.com:636<br>
[ldap] waiting for bind result ...<br>
[ldap] Bind was successful<br>
[ldap] user testuser authenticated succesfully<br>
++[ldap] returns ok<br>
# Executing section post-auth from file
/etc/raddb/sites-enabled/default<br>
+- entering group post-auth {...}<br>
++[exec] returns noop<br>
Sending Access-Accept of id 75 to 10.10.10.10 port 33651<br>
<br>
Why doesn't radius find Check item value pair? It does exists in
radcheck table...<br>
Does it only work for local mysql users?<br>
<br>
Matej<br>
<pre class="moz-signature" cols="72">--
---
Matej Zerovnik</pre>
</body>
</html>