Actually, on second thought, this breaks things worse in the Moonshot world... :-/
When I add this block above the 'update { ... }' block in the post-auth section, things work again:
update reply { User-Name !* ANY }
So there's some leakage going on...
(7) # Executing section post-auth from file /etc/raddb/sites-enabled/abfab-tr-idp (7) post-auth { (7) update { (7) &reply::Moonshot-Host-TargetedId += &session-state:Moonshot-Host-TargetedId[*] -> '33127397-1bb6-5e95-8859-dfe76acfba67@idp.test.assent' (7) &reply::Moonshot-Realm-TargetedId += &session-state:Moonshot-Realm-TargetedId[*] -> 'abd0d71b-7294-5423-86b1-3fae0bd7b33a@idp.test.assent' (7) &reply::Moonshot-TR-COI-TargetedId += &session-state:Moonshot-TR-COI-TargetedId[*] -> 'b40d0def-5b25-52bd-8d13-e6d22fa24648@idp.test.assent' (7) &reply::EAP-Channel-Binding-Message += &session-state:EAP-Channel-Binding-Message[*] -> 0x02002a01a40648545450a524736572766963652e6d6f6f6e73686f742d706c617970656e2e74692e6a612e6e6574 (7) &reply::Reply-Message += &session-state:Reply-Message[*] -> 'Bob has authenticated' (7) &reply::User-Name += &session-state:User-Name[*] -> 'root' (7) } # update = noop (7) [exec] = noop (7) policy remove_reply_message_if_eap { (7) if (&reply:EAP-Message && &reply:Reply-Message) { (7) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (7) if (&reply:EAP-Message && &reply:Reply-Message) { (7) update reply { (7) &Reply-Message !* ANY (7) } # update reply = noop (7) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (7) ... skipping else: Preceding "if" was taken (7) } # policy remove_reply_message_if_eap = noop (7) } # post-auth = noop (7) Sent Access-Accept Id 83 from 0.0.0.0:2083 to 13.94.115.212:48186 length 0 (7) MS-MPPE-Recv-Key = 0x1ee8bbd31cd79fd4e98d946e946e1f976b7aaebd6e5412b4bab51b2e2d784c9c (7) MS-MPPE-Send-Key = 0x4de6d0ddcf7a725afc0a7e4b7fb2478b5c59a76ac5689342d33fbcdb4787f2c7 (7) EAP-Message = 0x03070004 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) User-Name = "@idp.test.assent" (7) Proxy-State = 0x30 (7) Moonshot-Host-TargetedId += "33127397-1bb6-5e95-8859-dfe76acfba67@idp.test.assent" (7) Moonshot-Realm-TargetedId += "abd0d71b-7294-5423-86b1-3fae0bd7b33a@idp.test.assent" (7) Moonshot-TR-COI-TargetedId += "b40d0def-5b25-52bd-8d13-e6d22fa24648@idp.test.assent" (7) EAP-Channel-Binding-Message += 0x02002a01a40648545450a524736572766963652e6d6f6f6e73686f742d706c617970656e2e74692e6a612e6e6574 (7) User-Name += "root" (7) Finished request Thread 3 waiting to be assigned a request Waking up in 4.2 seconds. (0) Cleaning up request packet ID 222 with timestamp +5 (1) Cleaning up request packet ID 207 with timestamp +5 (2) Cleaning up request packet ID 84 with timestamp +5 (3) Cleaning up request packet ID 66 with timestamp +5 (4) Cleaning up request packet ID 35 with timestamp +5 Closing TLS socket from client port 48186 (0) >>> send TLS 1.2 [length 0002] Client has closed connection (5) Cleaning up request packet ID 183 with timestamp +5 (6) Cleaning up request packet ID 189 with timestamp +5 ... shutting down socket auth from client (13.94.115.212, 48186) -> (*, 2083, virtual-server=abfab-idp) (7) Cleaning up request packet ID 83 with timestamp +5 Waking up in 2.9 seconds. ... cleaning up socket auth from client (13.94.115.212, 48186) -> (*, 2083, virtual-server=abfab-idp) Ready to process requests
-- log ends --
:-/
Stefan Paetow Consultant, Trust and Identity
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Stefan Paetow Consultant, Trust and Identity
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Stefan Paetow Consultant, Trust and Identity t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.