Dear All,
I am trying to implement huntgroups via MySQL according to http://wiki.freeradius.org/SQL_Huntgroup_HOWTO
On difference is the assignment of huntgroups not according to NAS-IP, but to
Called-Station-Id. The goal is to suppress roaming between hotspot routers, between
groups of hotspots.
For that purpose I have inserted the code
...
update request {
Huntgroup-Name := "%{sql02:select groupname from radhuntgroup where
calledstationid = '%{Called-Station-Id}'}"
}
...
In lieu of the module ‘preprocess’ into group ‘authorize’,
as advised in the HOWTO.
I have maintained the following entries in SQL tables:
`radhuntgroup`
`id`, `groupname`, `calledstationid`
1, 'Test-Rejec', '00-1D-7E-E7-96-9F'
`usergroup`
`UserName`, `GroupName`, `priority`
'yubvef13', 'TestGroup', 1
`radgroupcheck`
`id`, `GroupName`, `Attribute`, `op`, `Value`
1, 'TestGroup', 'Huntgroup-Name', ':=', 'Test'
One would expect the user to be rejected if the user tries
to log in to the router with the Called-Station-Id '00-1D-7E-E7-96-9F’,
However, the user is authenticated and not rejected.
Here the relevant parts of the debug:
...
Mon Jan 19 20:57:03 2009 : Info: sql_xlat
Mon Jan 19 20:57:03 2009 :
Debug: expand: %{User-Name} -> yubvef13
Mon Jan 19 20:57:03 2009 : Info: sql_set_user escaped user
--> 'yubvef13'
Mon Jan 19 20:57:03 2009 :
Debug: expand: select groupname from
radhuntgroup where calledstationid = '%{Called-Station-Id}' -> select
groupname from radhuntgroup where calledstationid = '00-1D-7E-E7-96-9F'
Mon Jan 19 20:57:03 2009 :
Debug: expand:
/var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Reserving
sql socket id: 3
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql:
query: select groupname from radhuntgroup where calledstationid =
'00-1D-7E-E7-96-9F'
Mon Jan 19 20:57:03 2009 : Info: sql_xlat finished
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Released
sql socket id: 3
Mon Jan 19 20:57:03 2009 :
Debug: expand: %{sql02:select groupname
from radhuntgroup where calledstationid = '%{Called-Station-Id}'} ->
Test-Rejec
Mon Jan 19 20:57:03 2009 : Info: ++[request] returns
notfound
Mon Jan 19 20:57:03 2009 : Info: ++[chap] returns noop
Mon Jan 19 20:57:03 2009 : Info: ++[mschap] returns noop
Mon Jan 19 20:57:03 2009 : Info: [suffix] No '@' in User-Name
= "yubvef13", looking up realm NULL
Mon Jan 19 20:57:03 2009 : Info: [suffix] No such realm
"NULL"
Mon Jan 19 20:57:03 2009 : Info: ++[suffix] returns noop
Mon Jan 19 20:57:03 2009 : Info: [eap] No EAP-Message, not
doing EAP
Mon Jan 19 20:57:03 2009 : Info: ++[eap] returns noop
Mon Jan 19 20:57:03 2009 : Info: ++- entering
redundant-load-balance group sql0203 {...}
Mon Jan 19 20:57:03 2009 :
Debug: expand: %{User-Name} -> yubvef13
Mon Jan 19 20:57:03 2009 : Info: [sql02] sql_set_user
escaped user --> 'yubvef13'
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Reserving
sql socket id: 2
Mon Jan 19 20:57:03 2009 :
Debug: expand: SELECT id, username,
attribute, value,
op FROM
radcheck WHERE
username = BINARY '%{SQL-User-Name}'
ORDER BY id -> SELECT id, username, attribute, value,
op FROM
radcheck WHERE
username = BINARY
'yubvef13' ORDER BY
id
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql:
query: SELECT id, username, attribute, value,
op FROM
radcheck WHERE
username = BINARY
'yubvef13' ORDER BY
id
Mon Jan 19 20:57:03 2009 : Info: [sql02] User found in
radcheck table
Mon Jan 19 20:57:03 2009 :
Debug: expand: SELECT id, username,
attribute, value, op
FROM radreply WHERE
username = BINARY
'%{SQL-User-Name}'
ORDER BY id -> SELECT id, username, attribute, value,
op FROM
radreply WHERE
username = BINARY 'yubvef13'
ORDER BY id
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql:
query: SELECT id, username, attribute, value,
op FROM
radreply WHERE
username = BINARY 'yubvef13'
ORDER BY id
Mon Jan 19 20:57:03 2009 :
Debug: expand: SELECT
groupname FROM
usergroup WHERE
username = BINARY
'%{SQL-User-Name}'
ORDER BY priority -> SELECT
groupname FROM
usergroup WHERE
username = BINARY
'yubvef13' ORDER BY
priority
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query:
SELECT groupname
FROM usergroup
WHERE username = BINARY
'yubvef13' ORDER BY
priority
Mon Jan 19 20:57:03 2009 :
Debug: expand: SELECT id, groupname,
attribute, Value,
op FROM radgroupcheck
WHERE groupname =
'%{Sql-Group}'
ORDER BY id -> SELECT id, groupname,
attribute, Value,
op FROM
radgroupcheck WHERE
groupname =
'TestGroup' ORDER
BY id
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query:
SELECT id, groupname,
attribute, Value,
op FROM
radgroupcheck WHERE
groupname =
'TestGroup' ORDER
BY id
Mon Jan 19 20:57:03 2009 : Info: [sql02] User found in group
TestGroup
Mon Jan 19 20:57:03 2009 : Debug: expand:
SELECT id, groupname,
attribute, value,
op FROM
radgroupreply WHERE
groupname =
'%{Sql-Group}'
ORDER BY id -> SELECT id, groupname,
attribute, value,
op FROM
radgroupreply WHERE
groupname =
'TestGroup' ORDER
BY id
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql:
query: SELECT id, groupname,
attribute, value,
op FROM
radgroupreply WHERE
groupname =
'TestGroup' ORDER
BY id
Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Released
sql socket id: 2
Mon Jan 19 20:57:03 2009 : Info: +++[sql02] returns ok
...
One thing I don’t get is, why is the rlm_sql_mysql
module finding the Hungroup-Name ‘Test-Rejec’ correctly, but module
‘request’ returns not found? The user is found in radgroupchek for
the correct usergroup ‘TestGroup’. As the values in radgroupcheck
and radgroupreplycheck do not match, the user should be rejected, but the user
is accepted.
What am I doing wrong?