Paul Long wrote:
A man page (http://www.die.net/doc/linux/man/man5/users.5.html) for the users file says, "Attribute := Value ... Always matches as a check item..." So does that mean, no matter what the value is, it will always
Well, the wording might be a bit confusing. FreeRadius works the following way: 1. All attribute-value pairs that come in are the "request" pairs 2. Internal server attribute per-request are the "config" pairs 3. Attribute-value pairs to go back to the client are the "reply" pairs someuser User-Password := "somevalue" ...actually sets (unconditionally) the User-Password AVP in the "config" items. This password is *COMPARED* to the password supplied by the client in the "request" items. It's not a simple equality - a CHAP request will require a challenge/response calculation with the config password + request challenge and then an equality test of the chap response.
match the attribute? I don't see that happening. As an experiment, I have a supplicant in a WiFi phone with user name of "plong" and password of "123". With the following entry in the users file:
plong Auth-Type = Local, User-Password := "126"
...I assumed it would match even though the value is different; however,
Though I realise the terminology might be initially confusing, how did you imagine a user with a password of "123" would be matched/accepted by a password of "126".
it does not match, and the access request is rejected:
rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 126 for user plong authentication. rlm_chap: Pasword check failed
To get it to match, I have to have the correct value:
plong Auth-Type = Local, User-Password := "123"
which results in this debug output:
rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 123 for user plong authentication. rlm_chap: chap user plong authenticated succesfully
Yes...
In fact, := behaves exactly like == in this case. What's the deal? Why doesn't := "always match?" Am I misunderstanding what it means to "match?"
As per man(5) users: Attribute := Value Always matches as a check item, and replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added. As a reply item, it has an identical meaning, but for the reply items, instead of the request items. Basically, := is a "force set" operator. In a "check" item, it sets a check/config pair. In a reply item, it sets/forces a reply pair. See doc/aaa.txt