Hi all, If I have mulitple sql groups, radgroupreply items that are returned are not restricted to the groups which the radgroupcheck items match. It seems that the first row of the radgroupreply table is returned to the nas (as long as the user is a member of this group however EVEN if the radreplyceck items do not match for this group). I assume that this is not correct? Is there therefore a way to get multiple sql groups to work correctly? Cheers, Stavros EscapeNet
Hi again, I just want to clarify my previous email. What I want is to authenticate one user who is in multiple groups. I am assuming that the group binding is occurring as a result of the check items, but this is where it appears to fail. In fact two separate problems are occurring with point 5 from http://wiki.freeradius.org/Rlm_sql 1. Incorrect radgroupreply items are being returned, dependant on database row order. I have found that the first group returned from usergroup is used for the reply, even if that group doesn't match the check items in radgroupcheck. 2. The user cannot authenticate at all when trying the second or subsequent groups (as returned from usergroup). For clarity I am trying to achieve the SQL equivalent of the lines below, however as we are doing chap I need to have the usernames and passwords stored in the database (radcheck). DEFAULT Auth-Type := Local, NAS-IP-Address == "10.0.0.1" Exec-Program-Wait = "/program for nas1" DEFAULT Auth-Type := Local, NAS-IP-Address == "10.0.0.2" Exec-Program-Wait = "/program for nas2" Is what I am trying to do possible, or is the server code need attention? PS; What happened to the new website? Cheers, Stavros EscapeNet
Stavros Patiniotis wrote:
For clarity I am trying to achieve the SQL equivalent of the lines below, however as we are doing chap I need to have the usernames and passwords stored in the database (radcheck).
DEFAULT Auth-Type := Local, NAS-IP-Address == "10.0.0.1" Exec-Program-Wait = "/program for nas1"
You don't need to set Auth-Type. And if the per-NAS configuration is fairly static, you can use rlm_passwd to map NAS to Exec-Program-Wait. Users should still go into SQL, as their information will change a fair bit.
PS; What happened to the new website?
What do you mean by that? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
DEFAULT Auth-Type := Local, NAS-IP-Address == "10.0.0.1" Exec-Program-Wait = "/program for nas1"
You don't need to set Auth-Type.
In the SQL database I am not setting it, its merely the NAS IP.
And if the per-NAS configuration is fairly static, you can use rlm_passwd to map NAS to Exec-Program-Wait. Users should still go into SQL, as their information will change a fair bit.
Doesn't this mean that we need to list every username in this file, so it can associate a user with a nas and with a Exec-Program? Then doesn't that mean every user is repeated for each NAS. I don't see the relationship?
PS; What happened to the new website?
What do you mean by that?
Ok, maybe its just my browser. Yesterday I was getting the new website, this morning I was getting the old webite, and now I'm seeing the new one again :) Time to clear out IE cache! Thanks!
participants (2)
-
Alan DeKok -
Stavros Patiniotis