On May 28, 2015, at 12:23 AM, d tbsky <tbskyd@gmail.com> wrote:
for example, If I use "test@upsteam" to authenticate, upstream will sent back "User-Name = test" alone with "Access-Accept". then the NAS will use username "test" to do accounting, not "test@upstream". but in my local accounting, I want to keep the nostrip name.
Then update that in the post-auth section: update reply { User-Name := "%{User-Name}" }
I know I can filter out the reply attribute, but should I do that? or there are better ways to do with this kind of situation. eg: upstream get the strip accounting name he wants, and I get the nostrip accounting name I want?
The post-auth section is designed to do this kind of thing.
and should I enable "attr_filter.post-proxy" to further protecting our site?
Yes. Alan DeKok.