On Tue, 4 May 2021, Matthew Newton wrote:
You can see in the debug output that it's returning in the inner tunnel, but not in the outer.
In fairness, I should say that *you* can see that, but I completely failed to understand the full implications of what the daemon was telling me.
The outer is what the NAS sees, so you need to copy the attributes so they are returned to the NAS.
That makes sense, thank you.
Set that to if (1), and it will copy the inner-tunnel reply into the session-state list. The attributes will then get copied from the session-state list to the outer reply in sites-available/default post-auth.
That works perfectly. Again, thank you a ton! For posterity and those who find this exchange in the archives, I will note that when the list-help says "We understand that the debug output is complex and full of what seems like magical text. You don't need to understand all of it. But the people on the mailing list do understand it, and can use it to help you." **it is not kidding**. -- Tom Yates - http://www.teaparty.net