Dominik George via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
My idea was to save the authenticated user in the auth phase in inner tunnel, then extract this again when the accounting request comes in. However, I can't get this to work.
As far as FreeRADIUS is concerned, the Authentication transaction and the Accounting transaction are two entirely different "sessions". Also, unless it is explicitly saved out by a module (like the TLS caching option for session resumption), "session-state" disappears after the authentication ends.
I verified that the NAS does correctly send the same Acct-Session-Id for both the auth ant the accounting requests, so FreeRADIUS should be able to correlate the state.
Yes but you'd need to use a module dedicated to doing so and call it where appropriate. Or, roll your own with rlm_cache, using the account session ID as the key and storing the desired username into the cache entry for that session when sending your Access-Accept, then retrieving it when receiving an Accounting Request. rlm_cache is, in general, a well tested and preferred internal mechanism for all such communication outside of the current session-state of a transaction. What you're looking to do is about maybe 15 lines of config/unlang. Takes a bit of time to wrap your head around the conventions for calling it though :-) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html