Using freeradius 1.1.6: I'm trying to establish a sequential auth order, but it seems I'm missing the boat on something. The goal is the following auth order, in iteration: 1) Check for local users in MySQL table 2) Proxy the request to another server 3) Use the local 'users' file (that is to permit all users, by default) In the 'authorize' clause, I have tried several configurations, but none seem to work as expected. In its most basic form, it was: authorize { preprocess sql suffix files } I have also tried modifying the clause using the 'redundant' and 'group' token: authorize { preprocess redundant { sql { notfound = 4 fail = 4 } suffix { notfound = 1 reject = 2 updated = 3 fail = 4 } } files } And lots of variations thereof. What seems to happen consistently, is that the 'suffix' clause supersedes the 'files' module, that is configured to permit all by default. Below is the debug: rad_recv: Access-Request packet from host 127.0.0.1:44323, id=85, length=59 User-Name = "xyzuser" User-Password = "foo" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering group redundant for request 0 radius_xlat: 'xyzuser' rlm_sql (sql): sql_set_user escaped user --> 'xyzuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'xyzuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User xyzuser not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'xyzuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'xyzuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User xyzuser not found in radgroupcheck rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 rlm_realm: No '@' in User-Name = "xyzuser", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "xyzuser" rlm_realm: Proxying request from user xyzuser to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall: leaving group redundant (returns notfound) for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 Sending Access-Request of id 0 to [DELETED] port 1645 User-Name = "xyzuser" User-Password = "foo" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Proxy-State = 0x3835 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Reject packet from host [DELETED]:1645, id=0, length=73 Nortel-Attr-1 = 0x00000000 Nortel-Attr-2 = 0x756e6b6e6f776e5f7573657220 Nortel-Attr-4 = 0x4e6f20737563682075736572 Login incorrect (Home Server says so): [xyzuser/foo] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request If I move the 'files' module before the 'suffix' module in the 'authorize' clause, it works fine. Again, it seems that the proxy over-rides any further processing, despite changing the priorities. Could anyone provide some idea as to what I'm missing, or how to make this work? Thank you in advance for any help! - Chris