Kolbjørn Barmen wrote:
I cannot remember to have seen multiple causes in play at once, but if that is the case, why not all of them? What I typically see is only one issue being the cause of a Reject. Of course there may be more, so that if you sort out one issue, it will just fail at the next one. But for any given attempt to authenticate, there is only one. Right?
There may be more than one, but there is usually only one.
Aha, so linelog can only deal with attributes?
Yes.
It would be nice if there was a way for a module to pass on error messages, if any, from "child" module instead of just printing its own, so that if a user is rejected due to wrong password for mschapv2, the error message from the rlm_eap_mschapv2 module would be printed instead of that from rlm_ldap, for example. Just wishfull thinking.
See Module-Failure-Message. Many modules (but not all) update that attribute. Alan DeKok.