On 1/9/20 1:08 PM, Alan DeKok wrote:
On Jan 9, 2020, at 4:05 PM, Matthew Schumacher <matt.s@aptalaska.net> wrote:
I can't seem to write a simple condition to match on a missing attribute. I just want to do this:
if( ! &reply:Filter-Id ) { update reply { Vendor-Address-List := foo } }
However, that always returns true, even if Filter-Id isn't returned in the Access-Accept. What does the debug output show?
That should work.
Alan DeKok.
(2) # Executing section post-auth from file /etc/freeradius/raddb/sites-enabled/server (2) post-auth { (2) if ( ! &reply:Filter-Id ) { (2) if ( ! &reply:Filter-Id ) -> TRUE (2) if ( ! &reply:Filter-Id ) { (2) update reply { (2) Vendor-Address-List := foo (2) } # update reply = noop (2) } # if ( ! &reply:Filter-Id ) = noop (2) } # post-auth = noop In the radius accept I see: Received Access-Accept Id 206 from 127.0.0.1:1812 to 127.0.0.1:49494 length 71 ..... Filter-Id = "117.in" Vendor-Address-List = "foo" .... Anyway, I found the problem, I am setting Filter-Id in ldap using: update { reply:Framed-Filter-Id = radiusfilter } And somewhere long the way radius, translates Framed-Filter-Id to Filter-Id. Once I changed it to: update { reply:Filter-Id = radiusfilter } It works correctly. I'm not sure why I originally had Framed-Filter-Id, or why radius was translating as I don't see anything that does that in the config. Thanks for the help, schu