Sql radgroupcheck match airespace-wlan-id
I suppose to have sort out this……but I want reject user "paolo" when coming from airespace-wlan-id = 5 radcheck 9 paolo Expiration := 15 May 2012 8 paolo Cleartext-Password := paolo radusergroup paolo rfxguest 0 radgroupcheck 4 rfxguest Airespace-Wlan-Id := 5 radgoupreply 1 rfxguest Auth-Type := Reject radius -X …. Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "xxxxxx" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" ….. [peap] Using saved attributes from the original Access-Accept Auth-Type := Reject Session-Timeout = 48445 User-Name = "paolo" [eap] Freeing handler ++[eap] returns ok Login OK: [paolo] (from client private-network-1 port 1 cli 00-24-36-b6-3a-22) EAP-PEAP tunnel reply attribute return Auth-Type = Reject but paolo is authenticated. Any details to look into to debug this ? Thanks fro any reply, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------
Hi Alan, this way paolo, since belong to rfxguest, is reject all the time radgroupcheck 5 rfxguest Auth-Type := Reject 4 rfxguest Airespace-Wlan-Id := 5 …let me change question…I admint I'm a bit confused….where is matched Airespace-Wlan-Id, I mean in which sql table. 3. Group processing then begins if any of the following conditions are met: a. The user IS NOT found in radcheck b. The user IS found in radcheck, but the check items don't match c. The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table d. The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes' 4. If groups are to be processed for this user, the first thing that is done is the list of groups this user is a member of is pulled from the usergroup table ordered by the priority field. The priority field of the usergroup table allows us to control the order in which groups are processed, so that we can emulate the ordering in the users file. This can be important in many cases. 5. For each group this user is a member of, the corresponding check items are pulled from radgroupcheck table and compared with the request. If there is a match, the reply items for this group are pulled from the radgroupreply table and applied. On 14/mag/2012, at 11:14, Alan DeKok wrote:
Paolo Barbato wrote:
radgoupreply
1 rfxguest Auth-Type := Reject
That should be in radgroupcheck, not in radgroupreply.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------
Paolo Barbato wrote:
radgroupcheck
5 rfxguest Auth-Type := Reject 4 rfxguest Airespace-Wlan-Id := 5
This is wrong. Read the doc/rlm_sql, and look at the operators.
…let me change question…I admint I'm a bit confused….where is matched Airespace-Wlan-Id, I mean in which sql table.
It's NOT matching. You're using ":=", not "==". And DON"T quote the documentation. I'm familiar with it. Alan DeKok.
Hi Alan…that it ! On 14/mag/2012, at 11:52, Alan DeKok wrote:
Paolo Barbato wrote:
radgroupcheck
5 rfxguest Auth-Type := Reject 4 rfxguest Airespace-Wlan-Id := 5
This is wrong. Read the doc/rlm_sql, and look at the operators.
…let me change question…I admint I'm a bit confused….where is matched Airespace-Wlan-Id, I mean in which sql table.
It's NOT matching. You're using ":=", not "==".
And DON"T quote the documentation. I'm familiar with it.
….OF COURSE not really for you, just to insert few line in the discussion, just like tags Many thanks again! Paolo.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------
participants (2)
-
Alan DeKok -
Paolo Barbato