nicolas.clo@ricoh-industrie.fr wrote:

Thanks Alan,

I tested with this but it won't works in Post-Auth Reject section in inner-tunnel I can't update reply-Message called in default virtual server, it is empty. Actually, the only way that I have is to enable logging in the two virtual servers, but I have two lines in logs for 1 reject.

Set "use_tunneled_reply = yes" The in the inner-tunnel post-auth section, do: update reply { Reply-Message := "... text ..." } That should work. Alan DeKok.

See below an old post message that I found on a forum Ok it's not up to date but the problem is the same : On 05/24/2011 05:03 PM, Alan Buxey wrote:

so, in inner-tunnel post-auth, set "outer.reply" to be whatever you want.. you can then, in the outer layer, query/check or use that reply.

Unfortunately, outer.reply is an Access-Challenge. Post by Phil mayers. nicolas.clo@ricoh-industrie.fr wrote:

Thanks Alan,

I tested with this but it won't works in Post-Auth Reject section in inner-tunnel I can't update reply-Message called in default virtual server, it is empty. Actually, the only way that I have is to enable logging in the two virtual servers, but I have two lines in logs for 1 reject.

Set "use_tunneled_reply = yes" The in the inner-tunnel post-auth section, do: update reply { Reply-Message := "... text ..." } That should work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

It works when the Access is an accept but not if it's a reject. if it's in post auth in inner-tunnel --> OK if it's in Post-Auth-Type REJECT --> nothing I want log only the reject reply-message. On 18/02/14 08:57, nicolas.clo@ricoh-industrie.fr wrote:

See below an old post message that I found on a forum

Ok it's not up to date but the problem is the same :

You're confusing two different suggestions. Yes, outer.reply is an Access-Challenge at that point. But Alan didn't say "set 'use_tunneled_reply = yes' and set 'outer.reply'". He said:

Set "use_tunneled_reply = yes"

The in the inner-tunnel post-auth section, do:

update reply { Reply-Message := "... text ..." }

See the difference? So, set the inner Reply-Message, and the magic in "use_tunneled_reply = yes" saves it, and resends it when the outer.reply is an Access-Accept/Reject. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hmmm OK. I feel less alone now .... it would be nice if you add this possibility . On 18/02/14 10:03, nicolas.clo@ricoh-industrie.fr wrote:

It works when the Access is an accept but not if it's a reject.

I believe that's a limitation of the current code: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_... It only checks and uses "use_tunneled_reply" on inner Accept. I seem to remember a discussion about changing it, but can't find the links. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On 19 Feb 2014, at 06:43, nicolas.clo@ricoh-industrie.fr wrote:

Is there a chance that it is implemented ?

Maybe. Add an issue on bugs.freeradius.org Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2