If I reference the same python module from mypython1 and mypython2 python mypython1 { module = example ... } python mypython2 { module = example ... } Then FreeRADIUS initializes and functions properly. However, if I use a different module for each, and in this test case a copy of same tested and functioning python program with a different name: python mypython1 { module = example ... } python mypython2 { module = example2 ... } I get the following error initializing: # Instantiating module "mypython2" from file /etc/freeradius/3.0/mods-enabled/mypython2 python_function_load - Module 'example2' not found <type 'exceptions.SystemError'> (null argument to internal routine) python_function_load - Failed to import python function 'example2.authorize' /etc/freeradius/3.0/mods-enabled/mypython2[2]: Instantiation failed for module "mypython2" Gary On Mon, Dec 4, 2017 at 3:07 PM, Alan DeKok <aland@deployingradius.com> wrote:

On Dec 4, 2017, at 5:03 PM, Gary Gwin <garygwin@gmail.com> wrote:

...

I need two distinct python module authorize methods. One for client authentication with the dynamic_clients virtual server and the other for user authorization in the default virtual server. I can detect state in a single python authorize method using various RADIUS request variables,

but

...

that seems fragile. What I'd really like is a way to use a different python authorize method for each the of the dynamci_clients and default virtual servers.

Makes sense...

...

Have had no luck configuring and referencing unique instance names as suggested in radiusd.conf:

# python mypython1 { # config_item = value # ... # }

# python mypython2 { # config_item = value # ... # }

I've tried various other configuration options.

Is this possible? If yes, what needs to be done?

Yes... just add raddb/mods-enabled/mypython1 with:

python mypython1 { ... python1 config ... }

and add raddb/mods-enabled/mypython2 with:

python mypython2 { ... python2 config ... }

The contents are the same as the normal 'python' module. The only real difference is the name (mypython1) and the script you're loading.

As always, what does the debug output say?

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

On 8 Dec 2017, at 02:53, Alan DeKok <aland@deployingradius.com> wrote:

On Dec 7, 2017, at 7:46 PM, Gary Gwin <garygwin@gmail.com> wrote:

...

If I reference the same python module from mypython1 and mypython2

python mypython1 { module = example ... }

python mypython2 { module = example ... }

Then FreeRADIUS initializes and functions properly.

Due to limitation in the Python interpreter, FreeRADIUS *cannot* instantiate multiple independent Python interpreters.

Any module you load has to be from one global Python module space / namespace.

...

However, if I use a different module for each, and in this test case a copy of same tested and functioning python program with a different name:

python mypython1 { module = example ... }

python mypython2 { module = example2 ... }

I get the following error initializing:

# Instantiating module "mypython2" from file /etc/freeradius/3.0/mods-enabled/mypython2 python_function_load - Module 'example2' not found <type 'exceptions.SystemError'> (null argument to internal routine) python_function_load - Failed to import python function 'example2.authorize' /etc/freeradius/3.0/mods-enabled/mypython2[2]: Instantiation failed for module "mypython2"

You should be able to load completely different Python modules, but they will both largely be running in the same interpreter.

In v3.0.x there should be different interpreter states which are swapped in and out depending on the thread and module instance. The states should be isolated from each other, so they should act like there are multiple interpreters even though there's only one. -Arran