Reject user if does not match group's checks
Although I saw some similar questions on forum, I didn't see a clear response to it. *The question is: *Is there a way to force user be rejected if it does not match check conditions for the group that belongs to? Thanks.
Hello Alan. Thanks for reply. There's no such a question in FAQ. Except this<http://wiki.freeradius.org/FAQ#How-do-I-deny-access-to-a-specific-user%2C-or-group-of-users%3F> and this<http://wiki.freeradius.org/FAQ#How-do-I-deny-access-to-a-specific-user%2C-or-group-of-users%3F> link that are somehow similar. But to be clearer, I'll explain more detailed what I need: I can have many groups. For any group, let's suppose I have declared in radgroupcheck many attributes (like Session-Timeout, Idle-Timeout, Login-Time, ...). Now I want that any user that tries to authenticate, no matter what group belongs to, if does not meet successfully the group checks, should be rejected. So, instead of adding in radcheck all group's attributes for every user, I want to have them only in radgroupcheck. That's the idea. (I think that will help FR work faster when there's a great amount of users.) Is that possible? P.S. You directed me to FAQ, but I can't understand how to achieve that, even after read FAQ. I'm a kind of newbie to FR. I explained my scenario in hopes I made myself understood. On Fri, Aug 3, 2012 at 6:57 PM, Alan DeKok <aland@deployingradius.com>wrote:
Andrei Petru Mura wrote:
Although I saw some similar questions on forum, I didn't see a clear response to it.
*The question is: *Is there a way to force user be rejected if it does not match check conditions for the group that belongs to?
See the FAQ.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Andrei Petru Mura wrote:
I can have many groups. For any group, let's suppose I have declared in radgroupcheck many attributes (like Session-Timeout, Idle-Timeout, Login-Time, ...).
Login-Time is a check attribute. Session-Timeout and Idle-Timeout are not.
Now I want that any user that tries to authenticate, no matter what group belongs to, if does not meet successfully the group checks, should be rejected.
This isn't really how group checks work. The limitation is due to the mathematical way group membership works, and not to FreeRADIUS.
So, instead of adding in radcheck all group's attributes for every user, I want to have them only in radgroupcheck. That's the idea. (I think that will help FR work faster when there's a great amount of users.) Is that possible?
I have no idea what you think you're doing. So I'm not sure how to answer the questions. Please read doc/rlm_sql. It describes in *detail* how the SQL module works. If you want to configure something for the user, make sure that it follows doc/rlm_sql. Then, it should work. The problem seems to be you're trying to configure "something" without fully understanding how the server works. So you're confused that your configuration doesn't do what you want. And you want to know how to "fix" the configuration. The answer is this: Don't fix the configuration. Fix your understanding of rlm_sql. Once you understand how it works, creating a configuration that works should be pretty simple.
P.S. You directed me to FAQ, but I can't understand how to achieve that, even after read FAQ. I'm a kind of newbie to FR. I explained my scenario in hopes I made myself understood.
Longer explanations are better. Alan DeKok.
On Mon, Aug 6, 2012 at 9:14 AM, Alan DeKok <aland@deployingradius.com>wrote:
Andrei Petru Mura wrote:
I can have many groups. For any group, let's suppose I have declared in radgroupcheck many attributes (like Session-Timeout, Idle-Timeout, Login-Time, ...).
Login-Time is a check attribute. Session-Timeout and Idle-Timeout are not.
Yes, I know. My mistake.
Now I want that any user that tries to authenticate, no matter what group belongs to, if does not meet successfully the group checks, should be rejected.
This isn't really how group checks work. The limitation is due to the mathematical way group membership works, and not to FreeRADIUS.
Yes, I know. But that's exact the behavior that I want to get from FR. How to make it working like that?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for help! I know that what I want to get from FR is implemented but in a different way. I just wanted to see if it is possible to get working how I wanted. Thanks a lot! On Mon, Aug 6, 2012 at 10:34 AM, Alan DeKok <aland@deployingradius.com>wrote:
Andrei Petru Mura wrote:
Yes, I know. But that's exact the behavior that I want to get from FR. How to make it working like that?
Do what I said in my last message. You deleted that part of my reply.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Andrei Petru Mura