radius authentication query not rejecting AUTH
Hi, Greetings. Hope you all are doing great! Following is the authentication query that I am using :- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' \ and vlan_id regexp '[[:<:]]%{NAS-Port}[[:>:]]'}" } if (&Tmp-String-0) { update request { Tmp-String-1 := "%{sql:update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } } Also tried if (&Tmp-String-0 != "") { in the above query. The initial record that we have in the table is a follows :- mysql> select * from raduserzone; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ | 1 | 100051 | 78-9E-D0-31-29-7E | 77,678 | 78-9E-D0-31-29-7E | +----+---------+-------------------+---------+-------------------+ Now when we try to switch the SSID to Guest space (VLAN_ID = 93) , the authentication query(above) did not seem to work as expected and it returns true every time we switch irrespective of the record in the raduserzone table. I have attached the debug logs file. On line 267 it says 'SQL query did not return any results' but still it updates the radusergroup table with a null value resulting in successfull AUTH on radius. It is not rejecting the AUTH somehow. Please suggest! I have already checked the mysql logs and the queries are working fine, if ran manually. Thanks
On Jun 6, 2016, at 7:59 AM, Amardeep Singh <aman.xsaintz@gmail.com> wrote:
Following is the authentication query that I am using :- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' \ and vlan_id regexp '[[:<:]]%{NAS-Port}[[:>:]]'}" } if (&Tmp-String-0) {
Which only checks if the attribute exists. It does NOT check if the attribute has any data in it.
update request { Tmp-String-1 := "%{sql:update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } }
Also tried if (&Tmp-String-0 != "") { in the above query.
Which should be better.
Now when we try to switch the SSID to Guest space (VLAN_ID = 93) , the authentication query(above) did not seem to work as expected and it returns true every time we switch irrespective of the record in the raduserzone table.
Because you're checking if the attribute exists, not if the attribute has any data.
I have attached the debug logs file. On line 267 it says 'SQL query did not return any results' but still it updates the radusergroup table with a null value resulting in successfull AUTH on radius. It is not rejecting the AUTH somehow. Please suggest!
Use: if (&Tmp-String-0 != "") Alan DeKok.
Hi Alan, Thanks for looking into this. I tried changing the authentication query as follows :- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' \ and vlan_id regexp '[[:<:]]%{NAS-Port}[[:>:]]'}" } if(&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql:update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } But still the same results and the radius AUTH is getting successful. I have attached the new log file for the same. Please suggest! Thanks, Amardeep On Mon, Jun 6, 2016 at 11:54 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 6, 2016, at 7:59 AM, Amardeep Singh <aman.xsaintz@gmail.com> wrote:
Following is the authentication query that I am using :- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' \ and vlan_id regexp '[[:<:]]%{NAS-Port}[[:>:]]'}" } if (&Tmp-String-0) {
Which only checks if the attribute exists. It does NOT check if the attribute has any data in it.
update request { Tmp-String-1 := "%{sql:update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } }
Also tried if (&Tmp-String-0 != "") { in the above query.
Which should be better.
Now when we try to switch the SSID to Guest space (VLAN_ID = 93) , the authentication query(above) did not seem to work as expected and it returns true every time we switch irrespective of the record in the raduserzone table.
Because you're checking if the attribute exists, not if the attribute has any data.
I have attached the debug logs file. On line 267 it says 'SQL query did not return any results' but still it updates the radusergroup table with a null value resulting in successfull AUTH on radius. It is not rejecting the AUTH somehow. Please suggest!
Use:
if (&Tmp-String-0 != "")
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 7, 2016, at 1:39 AM, Amardeep Singh <aman.xsaintz@gmail.com> wrote:
I tried changing the authentication query as follows :- ... But still the same results and the radius AUTH is getting successful. I have attached the new log file for the same. Please suggest!
Well, it should work.. It works for me. Which version are you running? Alan DeKok.
Hi, I am running : - 2.2.6 version of radius Thanks, Amardeep On Tue, Jun 7, 2016 at 5:49 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 7, 2016, at 1:39 AM, Amardeep Singh <aman.xsaintz@gmail.com> wrote:
I tried changing the authentication query as follows :- ... But still the same results and the radius AUTH is getting successful. I have attached the new log file for the same. Please suggest!
Well, it should work.. It works for me.
Which version are you running?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Amardeep Singh