On Dec 20, 2015, at 10:43 AM, Amir Tal <amir@ccc.co.il> wrote:

Using freeradius 2.1.12 on centos 5 Users are saved in LDAP, accounting data in MySQL.

OK. Though it would be better to use a version of the server which isn't 5 years old.

We are looking to implement IP addresses allocation in radius, using Rlm_sqlippool. Already implemented sql host with pool data (added sqlippool to /etc/raddb/sites-enabled/default) , working as expected.

That's good.

We do not want to add pool info the LDAP entries, but have the radius assign a pool according to other (existing) parameters.

Added the following to 'post-auth' of /etc/raddb/sites-enabled/default (users with radiusReplyItem of certain type should get a radiusCheckItem with pool name): ... if ( radiusReplyItem =~ /fast/i ) { update request { radiusCheckItem := "Pool-Name := test_pool"

Huh? What is what? You can't just randomly invent names and use them. The things you're checking are RADIUS attributes names. See "man unlang". This is documented.

Two issues exists with this :

1) it's completely wrong 2) because it's wrong, it will never do what you want

1. Condition is never met, even for users that have :

radiusReplyItem = "Framed-Pool:=fast"

Please read the docs. The "radiusReplyItem" is a field in LDAP. The configuration above sets the *RADIUS* attribute named "Framed-Pool" to have value "fast". It does *not* let you do checks against a "radiusReplItem" thing.

2. Cannot even start radius with this syntax, I get an error:

Sun Dec 20 17:37:41 2015 : Error: /usr/local/etc/raddb/sites-enabled/default[483]: ERROR: Invalid vendor name in attribute name "radiusCheckItem"

That should give you a hint that the configuration is invalid.

How can this be used for 'radiusCheckItem' and 'radiusReplyItem' ? it this possible at all?

I have no idea what you think 'radiusCheckItem' and 'radiusReplyItem' are doing. Read the documentation for the LDAP module: http://wiki.freeradius.org/modules/Rlm_ldap That should make it clear how things work. Alan DeKok.