Attributes from DEFAULT user are always used although there's a more specific user
Hello, i try to use files and SQL for authentication. In my users file, i have a DEFAULT user and a specific user 'HSI/DEU.MYID.47110815' in SQL radcheck/radreply table. If my user is authenticated, Attributes from respective user *and* from DEFAULT user are replied to the nas although there is no explicit "Fall-Through = Yes" attribute. Is that an excpected behaviour ? How can i achieve that only attributes from specific user is replied and those from DEFAULT user are only replied, when there is no accurate user. root@quagga:/opt/freeradius/etc/raddb# more users DEFAULT User-Name =~ "^HSI.*", Auth-Type := Accept Class = "Default" reply-detail-20171221: Thu Dec 21 14:43:52 2017 Packet-Type = Access-Accept Class = 0x44656661756c74 ERX-Virtual-Router-Name == "VRF-132" mysql> select * from radreply; +----+-----------------------+-------------------------+----+---------+ | id | username | attribute | op | value | +----+-----------------------+-------------------------+----+---------+ | 4 | HSI/DEU.MYID.47110815 | ERX-Virtual-Router-Name | == | VRF-132 | +----+-----------------------+-------------------------+----+---------+ Freeradius version is 2.2.10. Attached you also find a debug from the mentioned authentication request. Regards, Alex
On Dec 21, 2017, at
i try to use files and SQL for authentication. In my users file, i have a DEFAULT user and a specific user 'HSI/DEU.MYID.47110815' in SQL radcheck/radreply table. If my user is authenticated, Attributes from respective user *and* from DEFAULT user are replied to the nas although there is no explicit "Fall-Through = Yes" attribute. Is that an excpected behaviour ?
Yes. The "files" module and the "sql" module run completely independently. Fall-Through is only applied inside of one module. e.g. for entries in the "users" file. It doesn't affect inter-module behaviour.
How can i achieve that only attributes from specific user is replied and those from DEFAULT user are only replied, when there is no accurate user.
Have the DEFAULT entry in the "users" file set a special attribute, and then check for that.
root@quagga:/opt/freeradius/etc/raddb# more users DEFAULT User-Name =~ "^HSI.*", Auth-Type := Accept Class = "Default"
That's good. And then wrap the call to the SQL module with a check for this situation: ... if (reply:Class ~= "Default") { sql } ... Alan DeKok.
On Dec 21, 2017, at 3:56 PM, Alex D. <listensammler@gmx.de> wrote:
That's good. And then wrap the call to the SQL module with a check for this situation:
... if (reply:Class ~= "Default") { sql } ... Okay. I will try this. Where do i have to put this snippet ?
Where you see "sql" in sites-enable/... Alan DeKok.
participants (2)
-
Alan DeKok -
Alex D.