"CHui" <CHui@lbl.gov> wrote:

...

Although it seems to work for me, I am not sure about the use of attribute Class for tracking user ID would interfere with other operation (like the one attribute Class was originally designed for)?

It was designed for local sites to do whatever they wanted. So you're doing the right thing.

...

Also, the attribute Class is of type Octet. Does anyone know of a way to convert it to text in SQL?

Edit the dictionary, and change "octets" to "string".

Alan DeKok.

Never thought of simply changing the attribute type in the dictionary file. Works great. Thanks. I use the "use_tunneled_reply = yes" in eap.conf to capture the user name inside of the tunnel. I have observed that the Class attribute now contained both the outer identity and the user name from inside the tunnel.

From the debug output:

Sending Access-Accept of id 170 to 198.128.24.10:1645 Class = "SomeoneElse" Cisco-AVPair = "ssid=CiscoTestAP" Session-Timeout = 60 Class = "chui.guest" MS-MPPE-Recv-Key = 0x... MS-MPPE-Send-Key = 0x... EAP-Message = 0x03070004 Message-Authenticator = 0x... User-Name = "SomeoneElse" Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 198.128.24.10:1646, id=112, length=262 Acct-Session-Id = "0600000000000204" Called-Station-Id = "0014.a800.44c0" Calling-Station-Id = "0002.2d27.05e2" Cisco-AVPair = "ssid= CiscoTestAP" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=unspecified" User-Name = "SomeoneElse" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "708" NAS-Port = 708 Class = "SomeoneElse" Class = "chui.guest" Service-Type = Framed-User NAS-IP-Address = 198.128.24.10 Acct-Delay-Time = 0 In the users file, I have the default entry as follows: DEFAULT Class = "{User-Name}", Fall-Through = No What should I do to get the Tunnel user name only instead of both send as reply attribute "Class"? Thanks Cedric