On Apr 23, 2018, at 11:51 AM, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
So, this is an authentication on FreeRADIUS 3.0.17 that I've just upgraded to on our 'playpen' network. Previously, it would simply return the User-Name as 'root' (I know, I know...) but now it appears that the server adds the outer User-Name *first*, and then restores the session-state one (which was set by the inner-tunnel as 'root').
There were situations where it *wouldn't* set the reply User-Name for EAP. That was fixed in 3.0.17. The debug log you posted shows no User-Name in the session-state list. Hmm... if I set the inner reply with a User-Name, and then set "use_tunneled_reply = yes", then the inner User-Name is copied to the outer one as expected. If I don't set "use_tunneled_reply", then the outer User-Name is just a copy of the one from the request, as expected. If I add a User-Name to the outer session-state list, then it's in the reply, *and* the one added by the EAP module. So that's wrong. The solution there is to have "eap" run in the post-auth section, and only add the reply User-Name there. But that's not going to change in a stable release. The solution to that would be to just remove any existing User-Name from the reply, before updating the session-state list: update reply { User-Name !* } update { &reply += &session-state: } I think that will work. But what are you expecting it to do, and when? Alan DeKok.