Contact (COEXSI) wrote:
Doing some tests with FreeRADIUS Version 2.2.3, we have noticed that the VSA attributes normally sent with an Access-Accept response were also sent on Access-Reject response. This was also observed with the Access-Challenge response sent by the server when doing EAP exchange.
This doesn't seem normal as per the FAQ : http://wiki.freeradius.org/guide/faq#VSA-in-Access-Reject "According RFC 2865 (section 5.44) Vendor-Specific Attributes aren't allow in Access-Reject packets."
You edited the default configuration, and broke it. The default configuration has the following: Post-Auth-Type REJECT { # log failed authentications in SQL, too. # sql attr_filter.access_reject } There is a similar line for EAP and Access-Challenge. The debug log shows you've removed the "attr_filter.access_reject" line. Which is why you're getting VSAs in the Access-Reject. Alan DeKok.