hi, all: I wanna catch sql module fail , therefore : site-enable/default: authorize { # # ... sql if (fail) { update reply { Session-Timeout := 300 } update control { Auth-Type := "Accept" } } # # } but debug output is : ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> yuanlin2 [sql] sql_set_user escaped user --> 'yuanlin2' rlm_sql (sql): Trying to (re)connect unconnected handle 4.. rlm_sql (sql): Attempting to connect rlm_sql_oraclet #4 rlm_sql_oraclet: Oracle logon failed: 'ORA-12541: TNS:no listener ' rlm_sql (sql): Failed to connect DB handle #4 rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 1 ++[sql] returns fail Invalid user: [yuanlin2/yuanlin] (from client vmhost port 123456) Using Post-Auth-Type Reject +- entering group REJECT {...} mmmmm, why ?? ================================== there is another solution below: in authorize section : redundant { sql files } in users file : DEFAULT Auth-Type := Accept Session-Timeout := 300 ================================== but , how to catch sql module fail ?