Hello!
I'm trying to use dailycounter on a LDAP authenticated user and it
doesn't seem to work. I think I did all steps correctly, but then
again, i have been wrong before:)
In radcheck table I added:
testuser Max-Daily-Session := 600
I enabled dailycounter in counters.conf:
sqlcounter dailycounter {
counter-name = Daily-Session-Time
check-name = Max-Daily-Session
reply-name = Session-Timeout
sqlmod-inst = sql
key = User-Name
reset = daily
query = "SELECT SUM(`Acct-Session-Time` - \
GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)),
0)) \
FROM accounting WHERE `User-Name` = '%{${key}}' AND
\
UNIX_TIMESTAMP(`Acct-Start-Time`) +
`Acct-Session-Time` > '%b'"
}
In sites-available/default I have the following:
authorize {
if (User-Password) {
update control {
Auth-Type := ldap
Ldap-UserDN :=
"eduPersonPrincipalName=%{User-Name},dc=example,dc=com"
}
}
sql
dailycounter
}
authenticate {
Auth-Type LDAP {
ldap
}
}
Debug output:
rad_recv: Access-Request packet from host 10.10.10.10 port 33651,
id=75, length=202
NAS-Port-Type = Wireless-802.11
Calling-Station-Id = "00:24:D7:47:1C:XX"
Called-Station-Id = "hs-kit-testing"
NAS-Port-Id = "bridge-bralci"
User-Name = "testuser"
NAS-Port = 2151677975
Acct-Session-Id = "80400017"
Framed-IP-Address = 192.168.81.198
Mikrotik-Host-IP = 192.168.81.198
User-Password = "password"
Service-Type = Login-User
WISPr-Logoff-URL = "http://192.168.81.1"
NAS-Identifier = "kit-testing"
NAS-IP-Address = 192.168.1.116
# Executing section authorize from file
/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++? if (User-Password)
? Evaluating (User-Password) -> TRUE
++? if (User-Password) -> TRUE
++- entering if (User-Password) {...}
expand:
eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi ->
eduPersonPrincipalName=testuser,dc=example,dc=com
+++[control] returns notfound
++- if (User-Password) returns notfound
[sql] expand: %{User-Name} -> testuser
[sql] sql_set_user escaped user --> 'testuser'
rlm_sql (sql): Reserving sql socket id: 2
[sql] expand: SELECT id, username, attribute, value, op
FROM radcheck WHERE username =
'%{SQL-User-Name}' ORDER BY id -> SELECT id, username,
attribute, value, op FROM radcheck WHERE
username = 'testuser' ORDER BY id
rlm_sql_mysql: query: SELECT id, username, attribute, value,
op FROM radcheck WHERE username =
'testuser' ORDER BY id
[sql] expand: SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}'
ORDER BY priority -> SELECT groupname FROM
radusergroup WHERE username = 'testuser' ORDER
BY priority
rlm_sql_mysql: query: SELECT groupname FROM
radusergroup WHERE username = 'testuser' ORDER
BY priority
rlm_sql (sql): Released sql socket id: 2
[sql] User testuser not found
++[sql] returns notfound
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[dailycounter] returns noop
Found Auth-Type = LDAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group LDAP {...}
[ldap] login attempt by "testuser" with password "password"
[ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com
[ldap] (re)connect to ldaps.example.com:636, authentication 1
[ldap] setting TLS mode to 1
[ldap] bind as
eduPersonPrincipalName=testuser,dc=example,dc=com/password to
ldaps.example.com:636
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] user testuser authenticated succesfully
++[ldap] returns ok
# Executing section post-auth from file
/etc/raddb/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 75 to 10.10.10.10 port 33651
Why doesn't radius find Check item value pair? It does exists in
radcheck table...
Does it only work for local mysql users?
Matej
--
---
Matej Zerovnik