Hello, In order to allow a user to access the service (send a Access-Accept) I need to validate several things: First the password must be OK: * The User-name and password are stored in cleartext in a ldap (I use Chap), I must get another ldap attribute wich specify the crm Id matching the username. The user must be allowed to use the service: * Daily I get a files matching a crm Id and a status (can access, cant access) => I can't have a matching between user-name / Status. The crm don't know the user-name, and the ldap don't know the client's status (only the Crm ID) I have no trouble to check the User-Name/Password using ldap and chap modules. But I can't figure out how to use the ldap reply to request the local mysql where is store the match between crm Id and status. I don't know how to use a reply of a authorization module (ldap) in an another one (sql). Since I didn't find out how to do this, I tried to add the crmID in a unused radius attribute: Callback-Number: In the ldap attrmap configuration file I added: replyItem Callback-Number SFRrelationLoginService And in the sql configuration: sql_user_name = "%{Callback-Number}" Unfortunately as expected the replyItem is only add when the reply is generate. I also tried with a checkItem without more success... Is it possible to configure the ldap module in order to store a ldapattribute in a variable usable by the mysql module ? Or to replace/add a radius attribute in the request, base on the ldap reply before the next module is compute? Examples : Goal case: echo "User-Name= toto,Chap-Password=111111", | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 202 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0xcab5c3da9c9ebb891608c1991c2e37bea3 rad_recv: Access-Reject packet from host 172.16.0.135 port 1812, id=202, length=20 log: Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> '' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User not found Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[scratchcounter_lyo] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[reply_log] returns ok Test addin the crmId in the request before computing => not possible in real situation, but to test everything else echo "User-Name= toto,Chap-Password=111111",Callback-Number='siebelsIdFortoto' | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 159 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0x9fb08ff7f454d0c9998fc5dd72479940cd Callback-Number = "siebelsIdFortoto" rad_recv: Access-Accept packet from host 172.16.0.135 port 1812, id=159, length=20 log: Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 got semaphore Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 handling request 0, (1 handled so far) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group authorize {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[preprocess] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[mschap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No '/' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[IPASS] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No '@' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[suffix] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[files] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] performing user authorization for toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{Stripped-User-Name} -> Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{User-Name} -> toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: (USERlogin=%{%{Stripped-User-Name}:-%{User-Name}}*) -> (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: ou=EndUser,dc=USER,dc=fr -> ou=EndUser,dc=USER,dc=fr Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Checking Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Got Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: attempting LDAP reconnection Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: (re)connect to 10.33.245.241:389, authentication 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: bind as cn=Radius Gp,ou=Application,dc=USER,dc=fr/radiusgp to 10.33.245.241:389 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Threads: total/active/spare threads = 5/1/4 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> siebelsIdFortoto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> 'siebelsIdFortoto' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = 'siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '=siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User siebelsIdFortoto not found Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} JJun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Finished request 0. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Going to the next request Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 waiting to be assigned a request Jun 16 12:33:30 radius-wifi1-aub freeradius[7106]: Waking up in 4.0 seconds. Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Cleaning up request 0 ID 159 with timestamp +4 Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Ready to process requests.