Matthew Schumacher wrote:
When I have a session that didn't get expired in a SQL database, and the user tries to connect then freeradius correctly checks the nas using the checkrad script *UNLESS* the nas is no longer defined in the clients. If the nas is missing, radius doesn't bother to call checkrad, and rejects the login as a multiple login.
Which is what it should do.
So if I deprecate a nas, remove it from the db, then restart freeradius, the next request comes in, free radius finds the session to be open, but then neither checks checkrad or accepts the user. The user is now unable to authenticate until I close the session in the SQL database.
Because the sessions are still open. When you delete the client from the DB, you should close all user sessions for that client. This is because the client won't do it... it's no longer a client.
Shouldn't freeradius call checkrad anyway and pass it the ip/session/user/port for the non-existent nas and let the checkrad script return 0, then let the user on? That's what I would have though should have happened.
No. Deleting a client means that the client doesn't exist. You shouldn't run checkrad against a client which doesn't exist. This is really an administration issue. Alan DeKok.