In which point does the FR sever send the Access-Accept or Access-Reject packet?
Hy all, I have a doubt about when FreeRadius server decides to send an Access-Accept or an Access-Reject packet. When the authenticate module returns with a RLM_MODULE_REJECT, does the FR server send an Access-Reject packet? or does it occur later? When the authenticate module returns with a RLM_MODULE_OK, does the FR server send the Access-Accept packet? or does it occur later? Thanks in advance, Marta --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es
Marta Lajas <marta_loops@yahoo.es> writes:
I have a doubt about when FreeRadius server decides to send an Access-Accept or an Access-Reject packet.
When the authenticate module returns with a RLM_MODULE_REJECT, does the FR server send an Access-Reject packet? or does it occur later?
When the authenticate module returns with a RLM_MODULE_OK, does the FR server send the Access-Accept packet? or does it occur later?
You can find the answers in src/main/modcall.c. The default authenticate actions are: { MOD_ACTION_RETURN, /* reject */ 1, /* fail */ MOD_ACTION_RETURN, /* ok */ MOD_ACTION_RETURN, /* handled */ 1, /* invalid */ MOD_ACTION_RETURN, /* userlock */ MOD_ACTION_RETURN, /* notfound */ 1, /* noop */ 1 /* updated */ }, Which means that both RLM_MODULE_REJECT and RLM_MODULE_OK will cause an immediate return action without calling any further modules in the authenticate section. Note that these actions may be modified by "redundant" or "append" module grouping, or even configured on code by code basis. See doc/configurable_failover The modules in postauth will of course still be called before sending Access-Reject or Access-Accept. Bjørn
Marta Lajas <marta_loops@yahoo.es> wrote:
I have a doubt about when FreeRadius server decides to send an Access-Accept or an Access-Reject packet.
Why ask the list when you can run it yourself and see?
When the authenticate module returns with a RLM_MODULE_REJECT, does the FR server send an Access-Reject packet? or does it occur later?
Yes. It *may* occur later because of "reject_delay". See radiusd.conf.
When the authenticate module returns with a RLM_MODULE_OK, does the FR server send the Access-Accept packet? or does it occur later?
Yes. And it's sent immediately. I can't help but think these questions are *not* the questions you want answered. What problem are you trying to solve? Alan DeKok.
participants (3)
-
Alan DeKok -
Bjørn Mork -
Marta Lajas