According to the rlm_sql: 5. For each group this user is a member of, the corresponding check items are pulled from radgroupcheck table and compared with the request. If there is a match, the reply items for this group are pulled from the radgroupreply table and applied. How many "check items" will freeradius check through? In my testing, it seems like on the first fail, it immediately goes to the next group. For example, I have the following in my radgroupcheck table: idgroupnameattributeopvalue 6mygroupPrefix==myprefix1 7mygroupPrefix==myprefix2 8mygroupAuth-Type:=Accept In my testing, if the user with myprefix2 fails authentication because it doesn't match "Prefix==myprefix1" and freeradius immediately searches through the next group as specified: 6. Processing continues to the next group IF: a. There was not a match for the last group's check items OR If I take out "Prefix==myprefix1" then the myprefix2 user authenticates correctly. Am I wrong in assuming freeradius will go through all check items for a group? Should I simply create two groups: mygroup1 and mygroup2? Where mygroup1 has Prefix==myprefix1 and mygroup2 has Prefix==myprefix2? Thanks for any clarification.
Jiann-Ming Su wrote:
According to the rlm_sql:
5. For each group this user is a member of, the corresponding check items are pulled from radgroupcheck table and compared with the request. If there is a match, the reply items for this group are pulled from the radgroupreply table and applied.
How many "check items" will freeradius check through? In my testing, it seems like on the first fail, it immediately goes to the next group.
The check items are *anded* together, via short-circuit evaluation. As soon as one result returns "false", the rest of the checks can be skipped. Alan DeKok.
On 06/02/2010 05:35 PM, Jiann-Ming Su wrote:
According to the rlm_sql:
5. For each group this user is a member of, the corresponding check items are pulled from radgroupcheck table and compared with the request. If there is a match, the reply items for this group are pulled from the radgroupreply table and applied.
How many "check items" will freeradius check through? In my testing, it seems like on the first fail, it immediately goes to the next group.
doc/rlm_sql says: In general, the SQL schemas mirror the layout of the 'users' file. So for configuring check items and reply items, see 'man 5 users', and the examples in the 'users' file. man 5 users says: The check items are a list of attributes used to match the incoming request. If the username matches, AND all of the check items match the incoming request, then the reply items are added to the list of attributes which will be used in the reply to that request. This process is repeated for all of the entries in the users file. doc/doc/processing_users_file: Then the request pairlist is compared with the tmpcheck pairlist. If all items match (except for password-related items at this time!) the following actions are taken: So there is your answer (and it's documented :-) and it matches the behavior you're seeing. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
participants (3)
-
Alan DeKok -
Jiann-Ming Su -
John Dennis