According to http://wiki.freeradius.org/config/Operators : = Attribute = Value Not allowed as a check item for RADIUS protocol attributes. It is allowed for server configuration attributes (Auth-Type, etc), and sets the value of on attribute, only if there is no other item of the same attribute. It specifically says Auth-Type (which does seem to be working), and Pool-Name is another control attribute: mysql> select * from radgroupcheck where groupname = 'test_pool'; +----+-----------+-----------+----+-----------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-----------+ | 41 | TEST_POOL | Auth-Type | = | PAP | | 42 | TEST_POOL | Pool-Name | = | test_pool | +----+-----------+-----------+----+-----------+ 2 rows in set (0.00 sec) however with things set this way (I have a perl module defined to dump the various lists for debugging), Pool-Name does not get set:
(0) Wed Feb 10 15:47:11 2016: Debug: # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/peak (0) Wed Feb 10 15:47:11 2016: Debug: post-auth { (0) Wed Feb 10 15:47:11 2016: Debug: update { (0) Wed Feb 10 15:47:11 2016: Debug: No attributes updated (0) Wed Feb 10 15:47:11 2016: Debug: } # update = noop (0) Wed Feb 10 15:47:11 2016: Debug: sql: EXPAND .query (0) Wed Feb 10 15:47:11 2016: Debug: sql: --> .query (0) Wed Feb 10 15:47:11 2016: Debug: sql: Using query template 'query' (0) Wed Feb 10 15:47:11 2016: Debug: sql: EXPAND %{User-Name} (0) Wed Feb 10 15:47:11 2016: Debug: sql: --> radtest-pool (0) Wed Feb 10 15:47:11 2016: Debug: sql: SQL-User-Name set to 'radtest-pool' (0) Wed Feb 10 15:47:11 2016: Debug: sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{Cleartext-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) Wed Feb 10 15:47:11 2016: Debug: sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 15:47:11') (0) Wed Feb 10 15:47:11 2016: Debug: sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 15:47:11') (0) Wed Feb 10 15:47:11 2016: Debug: sql: SQL query returned: success (0) Wed Feb 10 15:47:11 2016: Debug: sql: 1 record(s) updated (0) Wed Feb 10 15:47:11 2016: Debug: [sql] = ok (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'radtest-pool' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '69.59.217.117' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '15762707' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '12:34:56:78:90:03' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'plo-cr1' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Feb 10 2016 15:47:11 PST' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> 'ether3.1900' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'PAP' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CHECK{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'PAP' (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '12:34:56:78:90:03' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'radtest-pool' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Feb 10 2016 15:47:11 PST' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'plo-cr1' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '69.59.217.117' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '15762707' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> 'ether3.1900' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &control:Cleartext-Password = $RAD_CHECK{'Cleartext-Password'} -> 'password' (0) Wed Feb 10 15:47:11 2016: Debug: perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'PAP' (0) Wed Feb 10 15:47:11 2016: Debug: [perl] = ok (0) Wed Feb 10 15:47:11 2016: Debug: sqlippool: No Pool-Name defined (0) Wed Feb 10 15:47:11 2016: Debug: sqlippool: EXPAND No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (0) Wed Feb 10 15:47:11 2016: Debug: sqlippool: --> No Pool-Name defined (did cli 12:34:56:78:90:03 port 15762707 user radtest-pool) (0) Wed Feb 10 15:47:11 2016: Debug: [sqlippool] = noop (0) Wed Feb 10 15:47:11 2016: Debug: } # post-auth = ok
If I change the operator to ":=" (the "set it dammit no matter what" operator), it does the right thing: mysql> select * from radgroupcheck where groupname = 'test_pool'; +----+-----------+-----------+----+-----------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-----------+ | 41 | TEST_POOL | Auth-Type | := | PAP | | 42 | TEST_POOL | Pool-Name | := | test_pool | +----+-----------+-----------+----+-----------+ 2 rows in set (0.00 sec)
(0) Wed Feb 10 16:13:29 2016: Debug: post-auth { (0) Wed Feb 10 16:13:29 2016: Debug: update { (0) Wed Feb 10 16:13:29 2016: Debug: No attributes updated (0) Wed Feb 10 16:13:29 2016: Debug: } # update = noop (0) Wed Feb 10 16:13:29 2016: Debug: sql: EXPAND .query (0) Wed Feb 10 16:13:29 2016: Debug: sql: --> .query (0) Wed Feb 10 16:13:29 2016: Debug: sql: Using query template 'query' (0) Wed Feb 10 16:13:29 2016: Debug: sql: EXPAND %{User-Name} (0) Wed Feb 10 16:13:29 2016: Debug: sql: --> radtest-pool (0) Wed Feb 10 16:13:29 2016: Debug: sql: SQL-User-Name set to 'radtest-pool' (0) Wed Feb 10 16:13:29 2016: Debug: sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{Cleartext-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) Wed Feb 10 16:13:29 2016: Debug: sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 16:13:29') (0) Wed Feb 10 16:13:29 2016: Debug: sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 16:13:29') (0) Wed Feb 10 16:13:29 2016: Debug: sql: SQL query returned: success (0) Wed Feb 10 16:13:29 2016: Debug: sql: 1 record(s) updated (0) Wed Feb 10 16:13:29 2016: Debug: [sql] = ok (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'radtest-pool' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '69.59.217.117' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '15762707' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '12:34:56:78:90:03' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'plo-cr1' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Feb 10 2016 16:13:29 PST' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> 'ether3.1900' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Service-Type'} = &reply:Service-Type -> 'Framed-User' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-Protocol'} = &reply:Framed-Protocol -> 'PPP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-IP-Netmask'} = &reply:Framed-IP-Netmask -> '255.255.255.255' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-MTU'} = &reply:Framed-MTU -> '1500' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-Compression'} = &reply:Framed-Compression -> 'None' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Mikrotik-Rate-Limit'} = &reply:Mikrotik-Rate-Limit -> '20M/10M' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'PAP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CHECK{'Pool-Name'} = &control:Pool-Name -> 'test_pool' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CHECK{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'PAP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CONFIG{'Pool-Name'} = &control:Pool-Name -> 'test_pool' (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '12:34:56:78:90:03' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'radtest-pool' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Feb 10 2016 16:13:29 PST' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'plo-cr1' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '69.59.217.117' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '15762707' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> 'ether3.1900' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-Protocol = $RAD_REPLY{'Framed-Protocol'} -> 'PPP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Service-Type = $RAD_REPLY{'Service-Type'} -> 'Framed-User' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Mikrotik-Rate-Limit = $RAD_REPLY{'Mikrotik-Rate-Limit'} -> '20M/10M' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-Compression = $RAD_REPLY{'Framed-Compression'} -> 'None' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-IP-Netmask = $RAD_REPLY{'Framed-IP-Netmask'} -> '255.255.255.255' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-MTU = $RAD_REPLY{'Framed-MTU'} -> '1500' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &control:Cleartext-Password = $RAD_CHECK{'Cleartext-Password'} -> 'password' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'PAP' (0) Wed Feb 10 16:13:29 2016: Debug: perl: &control:Pool-Name = $RAD_CHECK{'Pool-Name'} -> 'test_pool' (0) Wed Feb 10 16:13:29 2016: Debug: [perl] = ok (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND %{User-Name} (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> radtest-pool (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: SQL-User-Name set to 'radtest-pool' (0) Wed Feb 10 16:13:29 2016: ERROR: sqlippool: Clear stale connections (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND START TRANSACTION (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> START TRANSACTION (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: START TRANSACTION (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND COMMIT (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> COMMIT (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: COMMIT (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND START TRANSACTION (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> START TRANSACTION (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: START TRANSACTION (0) Wed Feb 10 16:13:29 2016: ERROR: sqlippool: allocate_find (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL or expiry_time = 0) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'test_pool' AND (expiry_time < NOW() OR expiry_time IS NULL or expiry_time = 0) ORDER BY (username <> 'radtest-pool'), (callingstationid <> '12:34:56:78:90:03'), expiry_time LIMIT 1 FOR UPDATE (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'test_pool' AND (expiry_time < NOW() OR expiry_time IS NULL or expiry_time = 0) ORDER BY (username <> 'radtest-pool'), (callingstationid <> '12:34:56:78:90:03'), expiry_time LIMIT 1 FOR UPDATE (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Allocated IP 10.98.0.4 (0) Wed Feb 10 16:13:29 2016: ERROR: sqlippool: allocate_update (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.98.0.4' (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> UPDATE radippool SET nasipaddress = '69.59.217.117', pool_key = '12:34:56:78:90:03', callingstationid = '12:34:56:78:90:03', username = 'radtest-pool', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.98.0.4' (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: UPDATE radippool SET nasipaddress = '69.59.217.117', pool_key = '12:34:56:78:90:03', callingstationid = '12:34:56:78:90:03', username = 'radtest-pool', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.98.0.4' (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND COMMIT (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> COMMIT (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: COMMIT (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> Allocated IP: 10.98.0.4 from test_pool (did cli 12:34:56:78:90:03 port 15762707 user radtest-pool) (0) Wed Feb 10 16:13:29 2016: Debug: [sqlippool] = ok (0) Wed Feb 10 16:13:29 2016: Debug: } # post-auth = ok