I've semi-sorted it by setting a Reply-Message and then using Unlang to lookup that message a bit ugly, but it works.

In my post-auth section I have:

        files
        if ("%{reply:Reply-Message}" == "Reject") {
                reject
        }

And in the postauth_users I have:

DEFAULT Auth-Type := Reject
        Reply-Message = "Reject"

Which gives me this in the trace:

++[files] returns ok
++? if ("%{reply:Reply-Message}" == "Reject")
        expand: %{reply:Reply-Message} -> Reject
? Evaluating ("%{reply:Reply-Message}" == "Reject") -> TRUE
++? if ("%{reply:Reply-Message}" == "Reject") -> TRUE
++- entering if ("%{reply:Reply-Message}" == "Reject") {...}
+++[reject] returns reject
++- if ("%{reply:Reply-Message}" == "Reject") returns reject
Using Post-Auth-Type Reject
+- entering group REJECT {...}
++[reject] returns reject
Sending Access-Reject of id 76 to 192.168.143.72 port 2747
        Reply-Message = "Reject"



On Mon, Aug 9, 2010 at 3:36 PM, Peter Lambrechtsen <plambrechtsen@gmail.com> wrote:
Using FreeRadius 2.1.7 and trying to get the postauth_users to return an access reject however it always seems to return either a noop or ok.

This is what I get in my radiusd -X trace:

[files] postauth_users: Matched entry DEFAULT at line 30
++[files] returns ok
Sending Access-Accept of id 53 to 192.168.143.72 port 2503
        Reply-Message = "Your account has been disabled."

And this is what is in my postauth_users file:

DEFAULT Auth-Type := REJECT
        Post-Auth-Type = Reject,
        Reply-Message = "Your account has been disabled."

Checking the rlm_files.c it seems that either ok or noop are the two options returned:

        /*
         *      See if we succeeded.
         */
        if (!found)
                return RLM_MODULE_NOOP; /* on to the next module */

        return RLM_MODULE_OK;

Ideally I would assume if the Auth-Type := Reject then the return should be "RLM_MODULE_REJECT".

Since otherwise I think I will need to lookup if the Reply-Message is set to disabled, and then do a reject.

I'm no C developer hence why I am not offering up a patch, but I might try and see how difficult it would be.

Cheers

Peter