Hi Alan, Thanks heaps for your reply! :-)

...

So my basic question is: Does "authorize_check_query" complete fully before starting the call to "authorize_reply_query"?

To re-phrase your question:

Q: What work does the database perform after it's returned an answer from a SELECT?

A: Nothing.

That is true for a select statement, but my authorize_check_query is /not/ a simple select. It is this: authorize_check_query = "select id, username, attribute, value, op from\ auth('%{SQL-User-Name}', '%{NAS-IP-Address}')\ as (id integer, username varchar, attribute varchar, value varchar, op varchar)" the 'auth()' function is a plpgsql function that does a variety of lookups and other checks, and then depending on the results returned from that query, it *might* update database records, or it might insert additional data. Therefore, it is important to know whether authorize_check_query and authorize_reply_query execute synchronously or not.

...

If they happen at the same time, then I expect that 'authorize_reply_query' may execute before I get a chance to create the relevant records for the 'guest' user...

I know I can just go ahead and find out my answer by 'empirical method', but I figure that just because it seems to work every time, there is no definite guarantee that it will work *every* time unless I can be certain that these functions execute in sequence :-}

Databases ensure transactional consistency. This is the job of a database.

Yes, very true - so it is conveivably possible that authorize_reply_query is completed before my authorize_check_query has updated or inserted records. I'm sure that there is a definitive answer to this question "Does freeradius wait for the result of auth-check before running auth-reply?" and I am aware that it may not be the answer that I'd hope to hear ;-) but I'd still like to know it, noneteheless :-D Thanks - I really do appreciate any comments! Regards, Mike.

Thanks Padam! That's just what I was hoping to hear :-) Regards, Mike. From: freeradius-users-bounces+freeradius=duxtel.com@lists.freeradius.org [mailto:freeradius-users-bounces+freeradius=duxtel.com@lists.freeradius.org] On Behalf Of Padam J Singh Sent: Monday, 23 November 2009 8:57 PM To: FreeRadius users mailing list Subject: Re: authorize_check_query - authorize_reply_query - synchronous or asynchronous? Hi Mike, I use a similar setup (PG Functions for auth/acct) and I never had an issue with the query ordering. Padam freeradius@duxtel.com wrote: Hi Alan, Thanks heaps for your reply! :-) So my basic question is: Does "authorize_check_query" complete fully before starting the call to "authorize_reply_query"? To re-phrase your question: Q: What work does the database perform after it's returned an answer from a SELECT? A: Nothing. That is true for a select statement, but my authorize_check_query is /not/ a simple select. It is this: authorize_check_query = "select id, username, attribute, value, op from\ auth('%{SQL-User-Name}', '%{NAS-IP-Address}')\ as (id integer, username varchar, attribute varchar, value varchar, op varchar)" the 'auth()' function is a plpgsql function that does a variety of lookups and other checks, and then depending on the results returned from that query, it *might* update database records, or it might insert additional data. Therefore, it is important to know whether authorize_check_query and authorize_reply_query execute synchronously or not. If they happen at the same time, then I expect that 'authorize_reply_query' may execute before I get a chance to create the relevant records for the 'guest' user... I know I can just go ahead and find out my answer by 'empirical method', but I figure that just because it seems to work every time, there is no definite guarantee that it will work *every* time unless I can be certain that these functions execute in sequence :-} Databases ensure transactional consistency. This is the job of a database. Yes, very true - so it is conveivably possible that authorize_reply_query is completed before my authorize_check_query has updated or inserted records. I'm sure that there is a definitive answer to this question "Does freeradius wait for the result of auth-check before running auth-reply?" and I am aware that it may not be the answer that I'd hope to hear ;-) but I'd still like to know it, noneteheless :-D Thanks - I really do appreciate any comments! Regards, Mike. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

G'day!

<sigh> Do you understand how databases work?

Heheh - uh, yes: I understand how a database works!

Does the pgsql function do things AFTER it returns?

<duh> Of course not!

I have *no idea* how you concluded that when I said the exact opposite.

Hmmmm, I read your last reply again with hindsight gained from this new response, and I still can't interpret that comment as a definitive answer to the question.

Could you explain why my previous answer is incomprehensible to you?

I am wondering if this is a genuine question, or if there is some sarcastic or condescending undertone - but when I look at my last reply to you, I realise that those comments could be taken that way too! And since no such thing were intended, I'll respond anyway (whether you are interested or not! ;-) Perhaps I am missing some significant detail that is obvious to you...(?) I am coming to this discussion with the assumption that the two queries we are talking about might be executed synchronously by freeradius: as in both functions are called at the same time, and the radius reply packet is constructed from the joint results of both. Perhaps this is just a plain dumb idea, but that has been my thinking :-} I've done a bit (NOT a lot!) of C++ coding in the past, and I'm thinking of synchronous (vs asynchronous) functions that can be called essentially simultaneously by the core process, and then retrieved a few cycles later when the results of those functions have become available. If that were the case for freeradius db queries, then it is conceivable that the radius reply query could complete before the auth function had finished doing it's job. In fact the way I see it, and the way I have the database queries working at the moment, /if/ the radius reply were executed BEFORE the radius auth were called, the system would probably work just the same and with no noticeable effect on functionality! But all that aside, I now understand (although you have not actually *said* it ;-) that if radius_auth_query makes updates to the database, radius_reply_query result will ALWAYS reflect up those changes - and that is all that I need to know! So thanks indeed! :-) Much appreciated (truly - no sarcasm intended! :-) Cheers, Mike.