Access-Reject in a php script
Hi all! I am using a script for the authentication and it is working well. I can send a list of attributes without any problem. Now I want to send an "Access-Reject" if the authentication fails but I do not know how...I would be very grateful if someone could tell me how to do so. herein is a test script: #!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo "Session-Timeout:=100"; else echo "Access-Reject"; //NOT WORKING!!!!!! ?> Thanks a lot for your assistance Khalid :)
manIP wrote:
I am using a script for the authentication and it is working well. I can send a list of attributes without any problem. Now I want to send an "Access-Reject" if the authentication fails but I do not know how...I would be very grateful if someone could tell me how to do so. herein is a test script:
#!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo " Session-Timeout:=100"; else echo " Access-Reject"; //NOT WORKING!!!!!!
It's not documented as doing that. Have the script return an error, and no output. Alan DeKok.
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
echo "Session-Timeout:=100"; else echo "Access-Reject"; //NOT WORKING!!!!!!
hmmm, normally/properly you dont send such attributes back - thats a server job. you should simply exit with the return code that equals reject.
alan
That is correct. I had exactly the same problem and it took me a good while to figure out. I am still not certain if what I did was "correct" as far as how freeradius was designed, but it worked perfectly for me (and still is), so I am happy with the changes. I posted them to the list back then, check it out here: http://lists.cistron.nl/pipermail/freeradius-users/2007-May/063112.html What I found was that unlike perl and other languages where you can return an error code and exit clean, with PHP you have to exit with that error code - EG: exit(2); But when you exit(2) in PHP, freeradius thinks that the script failed and does not respond to the access-request... HTH Patric -- Q: I want to be a sysadmin. What should I do? A: Seek professional help. ---------------------------------------------------------------------- Find out how you can get spam free email. http://www.bluebottle.com/tag/3
Alan DeKok wrote:
Patric wrote:
But when you exit(2) in PHP, freeradius thinks that the script failed and does not respond to the access-request...
It delays the Access-Reject. See the debug output.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ah is that what happens! That delay was causing the access requests time out, and it appeared from the NAS point of view that it was getting no response... Thanks Alan -- Q: I want to be a sysadmin. What should I do? A: Seek professional help. ---------------------------------------------------------------------- Finally - A spam blocker that actually works. http://www.bluebottle.com/tag/4
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
manIP -
Patric