Update username attribute in NAS
Hey Everyone, I have few questions first: Can User-Name attribute be updated at NAS after authentication is completed(post auth)? Second if yes how? Third I have tried sending username in update reply but it didn't change. I can see the radius sending it though. [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'anirudh', 'superchor', 'Access-Accept', '2015-12-09 10:48:49') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'anirudh', 'superchor', 'Access-Accept', '2015-12-09 10:48:49') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 200 to 10.10.10.10 port 32769 User-Name = "anirudh" Finished request 4. Going to the next request Waking up in 4.9 seconds. PS: I am doing this to keep accounting from the sent username. Not the current username. PLEASE HELP! BR, Anirudh Malhotra
On 09-Dec-2015, at 10:58 am, Anirudh Malhotra <amalhotra.sp-dl@nkn.in> wrote:
Hey Everyone,
I have few questions first: Can User-Name attribute be updated at NAS after authentication is completed(post auth)?
From RFC 2865: 5.1. User-Name
This Attribute indicates the name of the user to be authenticated. It MUST be sent in Access-Request packets if available. * It MAY be sent in an Access-Accept packet, in which case the client SHOULD use the name returned in the Access-Accept packet in all Accounting-Request packets for this session.* So your NAS does not comply - it doesn’t need to because it’s not a MUST. Your best bet may be the Class attribute. It’s sent verbatim back to server in most NAS. Padam
Hi Padam, Thanks a lot for your email. But I have a question it is written it "MAY" be optionally sent by Radius, correct? . If in case it is sent NAS "SHOULD" comply with it and use that for all the accounting packets followed. Am I correct? Also I am sending it in update reply { }, which is being sent with access accept. So is it possible that access accept(which I dont know what is inside it) may be sending the old username only? BR, Anirudh Malhotra On Wednesday 09 December 2015 01:57 PM, Padam Jeet Singh wrote:
On 09-Dec-2015, at 10:58 am, Anirudh Malhotra <amalhotra.sp-dl@nkn.in> wrote:
Hey Everyone,
I have few questions first: Can User-Name attribute be updated at NAS after authentication is completed(post auth)? From RFC 2865: 5.1. User-Name
This Attribute indicates the name of the user to be authenticated. It MUST be sent in Access-Request packets if available.
* It MAY be sent in an Access-Accept packet, in which case the client SHOULD use the name returned in the Access-Accept packet in all Accounting-Request packets for this session.*
So your NAS does not comply - it doesn’t need to because it’s not a MUST.
Your best bet may be the Class attribute. It’s sent verbatim back to server in most NAS.
Padam
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, @Padam and magically when I recreate the access-request from NAS after receiving the first access accept+username from FR, and when I again receive the same reply from FR this time my cisco NAD takes the username :D haha , I have opened a TAC lets see what they have to say for this :P BR, Anirudh Malhotra On Wednesday 09 December 2015 02:55 PM, Anirudh Malhotra wrote:
Hi Padam,
Thanks a lot for your email.
But I have a question it is written it "MAY" be optionally sent by Radius, correct? . If in case it is sent NAS "SHOULD" comply with it and use that for all the accounting packets followed. Am I correct?
Also I am sending it in update reply { }, which is being sent with access accept. So is it possible that access accept(which I dont know what is inside it) may be sending the old username only?
BR, Anirudh Malhotra
On Wednesday 09 December 2015 01:57 PM, Padam Jeet Singh wrote:
On 09-Dec-2015, at 10:58 am, Anirudh Malhotra <amalhotra.sp-dl@nkn.in> wrote:
Hey Everyone,
I have few questions first: Can User-Name attribute be updated at NAS after authentication is completed(post auth)? From RFC 2865: 5.1. User-Name
This Attribute indicates the name of the user to be authenticated. It MUST be sent in Access-Request packets if available.
* It MAY be sent in an Access-Accept packet, in which case the client SHOULD use the name returned in the Access-Accept packet in all Accounting-Request packets for this session.*
So your NAS does not comply - it doesn’t need to because it’s not a MUST.
Your best bet may be the Class attribute. It’s sent verbatim back to server in most NAS.
Padam
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Anirudh Malhotra -
Padam Jeet Singh