Hi again...

I'm starting taking some confuse idea with this...

I use 3 checkvals.

1 for Calling-Station-Id

2 for Called-Station-Id

and 3 for Hints

and in the Hints file.. i setup my hints domains and filter to can apply for the suffix the correct acl/pool ip.

also have radiusHints and radiusFilterId in my OpenLDAP db.

now.. my question is.. why if Hints is not found in radius query... continue checking the rest for the values... and with any checkvals 1 or 2 works fine.. ??

so... if some user use other hints radius do access-accept... and not the reject like callings/called-station-id who with that... works fine..

simple debug.

[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=gtm478)
[ldap]  expand: ou=institute,ou=users,dc=sld,dc=cu -> ou=institute,ou=users,dc=domain,dc=com
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] performing search in ou=institute,ou=users,dc=domain,dc=com, with filter (uid=gtm478)
  [ldap] performing search in cn=users.ppp,ou=profiles,ou=radius,ou=services,dc=domain,dc=com, with filter (objectclass=radiusprofile)
  [ldap] radiusCalledStationId -> Called-Station-Id == "999999"
  [ldap] radiusCalledStationId -> Called-Station-Id == "888888"
  [ldap] radiusCalledStationId -> Called-Station-Id == "111111"
  [ldap] extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 90000
  [ldap] radiusIdleTimeout -> Idle-Timeout = 300
  [ldap] radiusSessionTimeout -> Session-Timeout = 7200
  [ldap] radiusFramedCompression -> Framed-Compression = Van-Jacobson-TCP-IP
  [ldap] radiusFramedMTU -> Framed-MTU = 576
  [ldap] radiusFilterId -> Filter-Id = "general.in"
  [ldap] radiusFramedProtocol -> Framed-Protocol = PPP
  [ldap] radiusServiceType -> Service-Type = Framed-User
[ldap] Added User-Password = {CRYPT}$1$passwordcrypted in check items
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
  [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$cryptedpassword"
  [ldap] radiusCallingStationId -> Calling-Station-Id == "111111"
[ldap] looking for reply items in directory...
[ldap] user gtm478 authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
rlm_checkval: Item Name: Calling-Station-Id, Value: 111111
rlm_checkval: Value Name: Calling-Station-Id, Value: 111111
++[checkval1] returns ok
rlm_checkval: Item Name: Called-Station-Id, Value: 88888
rlm_checkval: Value Name: Called-Station-Id, Value: 999999
rlm_checkval: Value Name: Called-Station-Id, Value: 88888
++[checkval2] returns ok
rlm_checkval: Item Name: Hint, Value: userdefault
rlm_checkval: Could not find attribute named Hint in check pairs
++[checkval3] returns notfound

I need to stop here.. and reject the user..

++? if (User-Name =~ /^(.+)@institute.domain.com/)
? Evaluating (User-Name =~ /^(.+)@institute.domain.com/) -> TRUE
++? if (User-Name =~ /^(.+)@institute.domain.com/) -> TRUE
++- entering if (User-Name =~ /^(.+)@institute.domain.com/) {...}
rlm_sqlcounter: Entering module authorize code

NOT should be continue.....

the users .. logging on...ok. (with bad hints)

with hints works fine.

thanxs in advance... (i'm continue searching and try meanwhilte wait for this...)

sorry for my bad english ..  O:-)

regards.

--
Antonio Peña
Secure email with PGP 0x8B021001 available at http://pgp.mit.edu
Fingerprint: 74E6 2974 B090 366D CE71  7BB2 6476 FA09 8B02 1001