problem with proxying

[Alan DeKok]

hacklberry wrote:
> Here is what I m trying to do:
> 
> use my module rlm_xxx to authenticate user bob
>    - if success i don't need anything else
> 
>    - if failure i want to proxy the authentication
>      request to a 3rd party RADIUS server

  This is difficult to do, because proxying *is* a kind of
authentication.  The server is designed to authenticate the user once.
What you want is "try this, if that doesn't work, try that".

  The way that people generally solve these problems is to separate
authentication and authorization.  They first see if the user is known.
 If so, authenticate locally.  If not, proxy.

  Alan DeKok.