On Jul 20, 2026, at 5:27 PM, Dominik George via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I am trying to do accounting for a user that previously authenticated through RADIUS. I know that the best way would be to use cui and have the NAS send a properly hashed identifier in its Accounting-Request, but unfortunately, my NAS does not support re-using the User-Name from the Access-Response for accounting. It always sends the anomymous identity from EAP instead.
Upgrade the NAS. :(
My idea was to save the authenticated user in the auth phase in inner tunnel, then extract this again when the accounting request comes in. However, I can't get this to work.
Save it *where*?
What I tried is to set
post-auth { update outer.session-state { User-Name := "%{User-Name}" } }
in inner tunnel, then
accounting { update request { User-Name := "%{session-state:User-Name}" } }
in the outer config. HOwever, it always is empty that way.
Yes. The session-state list is tracked only for Access-Request packets. If you want to store data across Access-Request to Accounting packets, put the information into a database.
I verified that the NAS does correctly send the same Acct-Session-Id for both the auth ant the accounting requests, so FreeRADIUS should be able to correlate the state.
The session-state list in FreeRADIUS has nothing to do with the Acct-Session-ID attribute.
The accounting request will ultimately be forwarded using the REST module.
Can anyone explain how I could get this to work?
In post-auth, save the User-Name information in a database, keyed by Acct-Session-Id. Then, update the "accounting" section to retrieve the User-Name from a database, keyed by Acct-Session-ID. Alan DeKok.