Thanks Alan. Got it working.

I've scoured the list and found your reply here in 2010 (http://lists.freeradius.org/pipermail/freeradius-users/2010-July/047686.html). I'm having the same problem - has this been fixed? post-auth is not being executed in inner-tunnel when the user is rejected. As a result no reject entry is being written to the table from inner tunnel.Is there a way to make it execute? I'm running 2.1.10+dfsg-3ubuntu0.12.04.1.

#inner tunnel
..snip..
post-auth {
..snip..
sql
Post-Auth-Type REJECT {
# log failed authentications in SQL, too.
sql
attr_filter.access_reject
}

update outer.reply {
User-Name = "%{request:User-Name}"
}

}

Thanks for all your help.

On 14 January 2014 16:51, Alan DeKok <aland@deployingradius.com> wrote:

P K wrote:
> Thanks Alan. I understand now. I've created my own postauth table and
> updated the sql query. My query is like this:

That should work.

> outer.request:User-Name works when this query is being executed from
> inner-tunnel but not in outer obviously. So I want to put an if
> condition. I'm fine with the syntax but i'm struggling to determine
> what to put a condition on. What variable should I look at to
> determine if I'm in inner or outer tunnel? I was thinking
> virtual-server .. not sure.

You put a condition on the expansion. See "man unlang"

%{%{outer.request:User-Name}:-NONE}

> Also I want to record protocol TTLS/PAP or PEAP/MSCHAP that has been
> in action. What variable should I use for this?

outer.request:EAP-Type.

> Is there a variable that would indicate the module that succeeded e.g
> ldap, mysql etc. so that I could record it? Auth-Type??

No. Because the EAP module is doing authentication.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html