Thank you very much Bjørn. So it is after the post-auth section when the FreeRadius server decides to send an Access-Accept or an Access-Reject packet (in response of a previous Access-Request packet) depending on the result (success or not, OK or REJECT) of the authenticate method. Am I right? Best regards, Marta ----- Original Message ----- From: "Bjørn Mork" To: "FreeRadius users mailing list" Sent: Thursday, January 05, 2006 12:42 PM Subject: Re: In which point does the FR sever send the Access-Accept orAccess-Reject packet?

Marta Lajas writes:

...

I have a doubt about when FreeRadius server decides to send an Access-Accept or an Access-Reject packet.

...

When the authenticate module returns with a RLM_MODULE_REJECT, does the FR server send an Access-Reject packet? or does it occur later?

...

When the authenticate module returns with a RLM_MODULE_OK, does the FR server send the Access-Accept packet? or does it occur later?

You can find the answers in src/main/modcall.c. The default authenticate actions are:

{ MOD_ACTION_RETURN, /* reject */ 1, /* fail */ MOD_ACTION_RETURN, /* ok */ MOD_ACTION_RETURN, /* handled */ 1, /* invalid */ MOD_ACTION_RETURN, /* userlock */ MOD_ACTION_RETURN, /* notfound */ 1, /* noop */ 1 /* updated */ },

Which means that both RLM_MODULE_REJECT and RLM_MODULE_OK will cause an immediate return action without calling any further modules in the authenticate section.

Note that these actions may be modified by "redundant" or "append" module grouping, or even configured on code by code basis. See doc/configurable_failover

The modules in postauth will of course still be called before sending Access-Reject or Access-Accept.

Bjørn

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es