Strangeness in work 'radgroup_check_query' through 'rlm_sql_unixodbc'
Hello, need help. 1. i have a test-machine with Ubuntu 14.04, Freeradius-server v2.1.12 and Informix Database Server v 10.00. 2. i use rlm_sql_unixodbc to connect Informix server. 3. When freeradius sends next simple request in Informix: group_membership_query = "select 'simult' groupname from TABLE(SET {1})" gets the answer: - rlm_sql_unixodbc: 07009 [unixODBC][Informix][Informix ODBC Driver]Invalid descriptor index. This request works in isql: SQL> select 'simult' groupname from TABLE(SET {1}); +----------+ | groupname| +----------+ | simul | +----------+ 4. Here the debug with '-X' option: Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.10 port 47385, id=240, length=58 User-Name = "test" CHAP-Password = 0xf05090f9d0fd90909fdfdg112 Framed-Protocol = PPP # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++? if (Framed-Protocol == PPP) ? Evaluating (Framed-Protocol == PPP) -> TRUE ++? if (Framed-Protocol == PPP) -> TRUE ++- entering if (Framed-Protocol == PPP) {...} [chap] Setting 'Auth-Type := CHAP' +++[chap] returns ok ++- if (Framed-Protocol == PPP) returns ok ++[mschap] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT first 1 1 id, '%{SQL-User-Name}' username, 'Password' attribute, trim(p.password) value, '==' op FROM acc a inner join details p on a.acc_id = p.acc_id WHERE username = '%{SQL-User-Name}' -> SELECT first 1 1 id, 'test' username, 'Password' attribute, trim(p.password) value, '==' op FROM acc a inner join details p on a.acc_id = p.acc_id WHERE username = 'test' WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: select 1 id, a.control username, 'Cisco-Account-Info' attribute, r.value value, '=' op from acc a inner join acc_b b on a.acc_id = b.acc_id inner join tq_p tp on tp.id = a.tq_p_id ............... and so on............... [sql] expand: select 'simult' groupname from TABLE(SET {1}) -> select 'simult' groupname from TABLE(SET {1}) rlm_sql_unixodbc: 07009 [unixODBC][Informix][Informix ODBC Driver]Invalid descriptor index. <---- Problem !!!! rlm_sql (sql): Released sql socket id: 3 ............... and so on............... 5. Others sql queries from dialup.conf such as: - nas_query - authorize_check_query - authorize_reply_query works well. 6. Is this bug only for group_membership_query? Does anyone experienced this ? -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.
Hello, need help.
1. i have a test-machine with Ubuntu 14.04, Freeradius-server
v2.1.12
Upgrade to 2.2.9. Alan DeKok.
Hello. 1. Upgraded to 2.2.9: #freeradius -v freeradius: FreeRADIUS Version 2.2.9, for host x86_64-pc-linux-gnu, built on Jan 15 2016 at 12:53:27 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. 2. The error persists: ............... Fri Jan 15 13:17:22 2016 : Info: [sql] expand: SELECT 'simult' groupname FROM TABLE(SET {1}) -> SELECT 'simult' groupname FROM TABLE(SET {1}) Fri Jan 15 13:17:22 2016 : Debug: query: SELECT 'simult' groupname FROM TABLE(SET {1}) Fri Jan 15 13:17:22 2016 : Error: rlm_sql_unixodbc: 07009 [unixODBC][Informix][Informix ODBC Driver]Invalid descriptor index. Fri Jan 15 13:17:22 2016 : Debug: rlm_sql (sql): Released sql socket id: 3 ............... 3. I want implement simultaneous use check by username. (Device send periodically accounting packets to freeradius. He writes it into the Informix.) I can do this only after receiving "Simultaneous use := 1" to my request , and no further?
Update:
I can do this only after receiving "Simultaneous use := 1" to my request , and no further?
I can do this only after receiving "Simultaneous use := 1" to my authorize_group_check_query request, and no further? For example - ... to my authorize_check_query request. -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.
Greeting. The problem was in unixODBC (in my case was version 2.2.14p2-5ubuntu5). Uninstall unixODBC. Install iODBC (version = 3.52.4-3). Everything works fine.
Alan, thank you! -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.
On Jan 15, 2016, at 5:47 AM, vanish <vanishox@coltel.ru> wrote:
2. The error persists: ...............
Fri Jan 15 13:17:22 2016 : Info: [sql] expand: SELECT 'simult' groupname FROM TABLE(SET {1}) -> SELECT 'simult' groupname FROM TABLE(SET {1}) Fri Jan 15 13:17:22 2016 : Debug: query: SELECT 'simult' groupname FROM TABLE(SET {1}) Fri Jan 15 13:17:22 2016 : Error: rlm_sql_unixodbc: 07009 [unixODBC][Informix][Informix ODBC Driver]Invalid descriptor index. Fri Jan 15 13:17:22 2016 : Debug: rlm_sql (sql): Released sql socket id: 3
OK. Doing a little more research, it looks like it's a problem with the ODBC API. The short summary is that the API is broken in undocumented ways. The longer summary is that you should probably switch to a different SQL driver.
3. I want implement simultaneous use check by username. (Device send periodically accounting packets to freeradius. He writes it into the Informix.)
I can do this only after receiving "Simultaneous use := 1" to my request , and no further?
That's how Simultaneous-Use works. See the Wiki. This is documented. Alan DeKok.
participants (2)
-
Alan DeKok -
vanish