Alan DeKok wrote 2016-12-20 16:03:
Don't do that. Use %{exec:...} instead of back-ticks for attributes in SQL.
Alan DeKok.
Alan, I'm sorry - maybe I do not fully understand what you mean?... Without back-ticks, FR interprets construction %{exec:...} as a simple string: MariaDB [radius]> select * from radgroupreply; +----+-----------+--------------+----+-------------------------------------------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------------------------------------------+ | 3 | ras | cisco-avpair | += | ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224 | | 14 | ras | Fall-Through | := | Yes | | 50 | ras | Cisco-AVPair | += | %{exec: /usr/bin/echo -n %{User-Name}} | +----+-----------+--------------+----+-------------------------------------------------------+ 3 rows in set (0.00 sec) Wed Dec 21 10:30:19 2016 : Debug: (0) sql: Group "ras": Merging reply items Wed Dec 21 10:30:19 2016 : Debug: (0) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Wed Dec 21 10:30:19 2016 : Debug: (0) sql: Fall-Through := Yes Wed Dec 21 10:30:19 2016 : Debug: (0) sql: Cisco-AVPair += "%{exec: /usr/bin/echo -n %{User-Name}}" ... Wed Dec 21 10:30:19 2016 : Debug: (0) Sent Access-Accept Id 74 from 172.18.200.21:1812 to 172.18.200.22:42637 length 0 Wed Dec 21 10:30:19 2016 : Debug: (0) Framed-Protocol = PPP Wed Dec 21 10:30:19 2016 : Debug: (0) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Wed Dec 21 10:30:19 2016 : Debug: (0) Cisco-AVPair += "%{exec: /usr/bin/echo -n %{User-Name}}" Wed Dec 21 10:30:19 2016 : Debug: (0) Reply-Message = "privacyIDEA access granted" Wed Dec 21 10:30:19 2016 : Debug: (0) Framed-Compression = Van-Jacobson-TCP-IP Wed Dec 21 10:30:19 2016 : Debug: (0) Finished request Alex Dotsenko.