Le 28/11/2014 16:51, Arran Cudbard-Bell a écrit :
On 28 Nov 2014, at 10:26, Philippe MARASSE <philippe.marasse@ch-poitiers.fr> wrote:
Le 28/11/2014 14:41, Alan DeKok a écrit :
On Nov 28, 2014, at 3:06 AM, Philippe MARASSE <philippe.marasse@ch-poitiers.fr> wrote:
So I'm wondering about the expected behavior : actually sql group processing stops after the first group, although the check item does not match (in my case Huntgroup does not match). Is this expected ? No. It should match and stop, or not match and continue. Perfect ! So I've not misunderstood :-).
I've just tested the patch proposed by Unrelated issue, should be fixed now. Just downloaded, it half works : as long as I have Fall-Through = yes on this user, it works :
(0) sql: EXPAND %{User-Name} (0) sql: --> 90fba6e49245 (0) sql: SQL-User-Name set to '90fba6e49245' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '90fba6e49245' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '90fba6e49245' ORDER BY id' (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := '90fba6e49245' (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '90fba6e49245' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = '90fba6e49245' ORDER BY id' (0) sql: User found in radreply table, merging reply items (0) sql: Fall-Through = Yes (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = '90fba6e49245' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = '90fba6e49245' ORDER BY priority' (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-miletrie' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-miletrie' ORDER BY id' (0) sql: Group "pcs-miletrie": Conditional check items matched (0) sql: Group "pcs-miletrie": Merging assignment check items (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'pcs-miletrie' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'pcs-miletrie' ORDER BY id' (0) sql: Group "pcs-miletrie": Merging reply items (0) sql: Tunnel-Type := VLAN (0) sql: Tunnel-Medium-Type := IEEE-802 (0) sql: Tunnel-Private-Group-Id := '100' rlm_sql (sql): Released connection (4) (0) [sql] = ok As mentioned, the first group does not match according to its Hunt-Group, the next group matches and reply items are correctly sent. If I remove Fall-Through = Yes from radreply table : (1) sql: EXPAND %{User-Name} (1) sql: --> 90fba6e49245 (1) sql: SQL-User-Name set to '90fba6e49245' rlm_sql (sql): Reserved connection (6) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '90fba6e49245' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '90fba6e49245' ORDER BY id' (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: Cleartext-Password := '90fba6e49245' (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '90fba6e49245' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = '90fba6e49245' ORDER BY id' (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = '90fba6e49245' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = '90fba6e49245' ORDER BY priority' (1) sql: User found in the group table (1) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' rlm_sql (sql): Released connection (6) (1) [sql] = ok The second group, which would match, is not processed. According to Alan's answer, it should have been processed. IMHO line 780 (rlm_sql.c) is involved : } while (entry != NULL && (*do_fall_through == FALL_THROUGH_YES)); If Fall-Through is not enabled, the next groups are never processed. So I've modified the logic in rlm_sql.c (see attachment), my first tests seems good. I'll try more tests next monday. Thanks. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19