Dear list, it looks like after upgrade from 3.0.17 to 3.0.19 successfully authenticated users are rejected in post-auth section with the error "Unable to set parent list". This applies only to users from our realm (self-proxied requests). Should configuration files be updated with regard to this update ? Almost the same config worked fine for 3.0.14, 3.0.15 and 3.0.17 (3.0.16 had issues with self-proxied requests though, but it had been fixed in tree just after release date). Please see attached diffs: # diff -U 2 sesjaok sesjafail --- sesjaok 2019-04-14 22:13:01.784098000 +0200 +++ sesjafail 2019-04-14 22:10:32.664311000 +0200 (...) @@ -4772,14 +4823,14 @@ (9) sql: --> .query (9) sql: Using query template 'query' -rlm_sql (sql): Reserved connection (6) +rlm_sql (sql): Reserved connection (0) (9) sql: EXPAND %{User-Name} (9) sql: --> testuser@realm.tld (9) sql: SQL-User-Name set to 'testuser@realm.tld' (9) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( '%{SQL-User-Name}', '%{Calling-Station-Id}', '%{reply:Packet-Type}', '%{Aruba-Location-Id}', '%S') -(9) sql: --> INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser@realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:13:01') -(9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser@realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:13:01') +(9) sql: --> INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser@realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:10:31') +(9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser@realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:10:31') (9) sql: SQL query returned: success (9) sql: 1 record(s) updated -rlm_sql (sql): Released connection (6) +rlm_sql (sql): Released connection (0) (9) [sql] = ok (9) if (1) { @@ -4797,21 +4848,48 @@ (9) } # update reply = noop (9) update { -(9) &outer.session-state::Chargeable-User-Identity += &reply:Chargeable-User-Identity[*] -> 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) } # update = noop -(9) } # if (1) = noop -(9) } # post-auth = ok -(9) Login OK: [testuser@realm.tld] (from client TEST-NET port 0 cli 02-00-00-00-00-01 via TLS tunnel) +(9) ERROR: Unable to set parent list +(9) } # update = fail +(9) } # if (1) = fail +(9) } # post-auth = fail +(9) Using Post-Auth-Type Reject +(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +(9) Post-Auth-Type REJECT { +(9) sql: EXPAND .query +(9) sql: --> .query +(9) sql: Using query template 'query' +rlm_sql (sql): Reserved connection (1) +(9) sql: EXPAND %{User-Name} +(9) sql: --> testuser@realm.tld +(9) sql: SQL-User-Name set to 'testuser@realm.tld' +(9) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( '%{SQL-User-Name}', '%{Calling-Station-Id}', '%{reply:Packet-Type}', '%{Aruba-Location-Id}', '%S') +(9) sql: --> INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser@realm.tld', '02-00-00-00-00-01', 'Access-Reject', '', '2019-04-14 22:10:31') +(9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser@realm.tld', '02-00-00-00-00-01', 'Access-Reject', '', '2019-04-14 22:10:31') +(9) sql: SQL query returned: success +(9) sql: 1 record(s) updated +rlm_sql (sql): Released connection (1) +(9) [sql] = ok +(9) inner_auth_log: EXPAND inner_auth_log.%{%{reply:Packet-Type}:-format} +(9) inner_auth_log: --> inner_auth_log.Access-Reject +(9) inner_auth_log: EXPAND user-auth#VISINST=%{request:Operator-Name}#USER=%{User-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{%{reply:Chargeable-User-Identity}:-%{outer.reply:Chargeable-User-Identity}}:-Local User}#RESULT=FAIL# +(9) inner_auth_log: --> user-auth#VISINST=1realm.tld#USER=testuser@realm.tld#CSI=02-00-00-00-00-01#NAS=Unknown Access Point#CUI=0x63353435653635306130656261383366316437303930663232336264326334373266666533613930#RESULT=FAIL# +(9) [inner_auth_log] = ok +(9) attr_filter.access_reject: EXPAND %{User-Name} +(9) attr_filter.access_reject: --> testuser@realm.tld +(9) attr_filter.access_reject: Matched entry DEFAULT at line 11 +(9) [attr_filter.access_reject] = updated +(9) update outer.session-state { +(9) ERROR: Unable to set parent list +(9) } # update outer.session-state = fail +(9) } # Post-Auth-Type REJECT = fail +(9) Rejected in post-auth: [testuser@realm.tld] (from client TEST-NET port 0 cli 02-00-00-00-00-01 via TLS tunnel) +(9) Login incorrect (Unable to set parent list): [testuser@realm.tld] (from client TEST-NET port 0 cli 02-00-00-00-00-01 via TLS tunnel) (9) } # server inner-tunnel (9) Virtual server sending reply -(9) Chargeable-User-Identity := 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) eap_peap: Got tunneled reply code 2 -(9) eap_peap: Chargeable-User-Identity := 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) eap_peap: Got tunneled reply RADIUS code 2 -(9) eap_peap: Chargeable-User-Identity := 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) eap_peap: Tunneled authentication was successful -(9) eap_peap: SUCCESS -(9) eap_peap: Saving tunneled attributes for later +(9) eap_peap: Got tunneled reply code 3 +(9) eap_peap: Got tunneled reply RADIUS code 3 +(9) eap_peap: Tunneled authentication was rejected +(9) eap_peap: FAILURE (9) eap: Sending EAP Request (code 1) ID 10 length 43 -(9) eap: EAP session adding &reply:State = 0x21a3f50328a9ec83 +(9) eap: EAP session adding &reply:State = 0xabcbb745a2c1aea2 (9) [eap] = handled (9) } # authenticate = handled @@ -4819,6 +4897,4 @@ (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/radius.realm.tld (9) Challenge { ... } # empty sub-section is ignored -(9) session-state: Saving cached attributes -(9) Chargeable-User-Identity += 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 (9) Finished internally proxied request. (9) Clearing existing &reply: attributes @@ -4830,5 +4906,5 @@ (9) post_proxy_log: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d expands to /var/log/radacct/172.x.y.z/post-proxy-detail-20190414 (9) post_proxy_log: EXPAND %t -(9) post_proxy_log: --> Sun Apr 14 22:13:01 2019 +(9) post_proxy_log: --> Sun Apr 14 22:10:31 2019 (9) [post_proxy_log] = ok (9) attr_filter.post-proxy: EXPAND %{Realm} -- Marek Zarychta