Which attribute-name is needed for group-filtering?

[Stefan Kuegler]

Hello.


Nobody has an idea?

Possibly I am on the wrong way - Is it possible to filter groups 
dependent on the attribute-name?

Best Regards,
Stefan

> I have a short question.
>
> I want to use multiotp as an authentication-module in freeradius on a
> debian-wheezy system.
> multiotp itself works properly. The authentication works as expected.
>
> But now the question:
> I want to filter the different users to groups using the "users"-file of
> freeradius, for example:
>
> DEFAULT Auth-type = multiotp, Group-Name := "allowed-users"
>          Reply-Message = "Your multiotp-account has been enabled."
>
> DEFAULT Auth-type = multiotp, Group-Name := "forbidden-users"
>          Reply-Message = "Your multiotp-account has been disabled."
>
>
> We are very free for setting an attribute-name in multiotp - but I don't
> know, which attribute-name do I have to set.
>
> I tested with different attribute names (like "Group-Name" in the
> example above). But nothing works. I only get the reply-message "Your
> multiotp-account has been enabled", everytime - even if the user is
> member of the group "allowed-users" or "forbidden-users".
>
> These are the last lines of debug-output. The user is member of the
> group "forbidden-users":
>
> [...]
> rad_recv: Access-Request packet from host 127.0.0.1 port 46615, id=111,
> length=77
>      User-Name = "testuser"
>      User-Password = "1234740472"
>      NAS-IP-Address = 127.0.1.1
>      NAS-Port = 0
>      Message-Authenticator = 0xdff73ff20f7d54045b999eae4cc891be
> # Executing section authorize from file
> /etc/freeradius/sites-enabled/default
> +- entering group authorize {...}
> ++[preprocess] returns ok
> ++[mschap] returns noop
> ++[digest] returns noop
> [suffix] No '@' in User-Name = "testuser", looking up realm NULL
> [suffix] No such realm "NULL"
> ++[suffix] returns noop
> [eap] No EAP-Message, not doing EAP
> ++[eap] returns noop
> [files] users: Matched entry DEFAULT at line 58
> ++[files] returns ok
> ++[expiration] returns noop
> ++[logintime] returns noop
> ++- entering policy multiotp.authorize {...}
> +++? if (!control:Auth-Type)
> ? Evaluating !(control:Auth-Type) -> FALSE
> +++? if (!control:Auth-Type) -> FALSE
> ++- policy multiotp.authorize returns noop
> [pap] WARNING! No "known good" password found for the user.
> Authentication may fail because of this.
> ++[pap] returns noop
> Found Auth-Type = multiotp
> # Executing group from file /etc/freeradius/sites-enabled/default
> +- entering group multiotp {...}
> [multiotp]     expand: %{User-Name} -> testuser
> [multiotp]     expand: %{User-Password} -> 1234740472
> [multiotp]     expand: -src=%{Packet-Src-IP-Address} -> -src=127.0.0.1
> [multiotp]     expand: -chap-challenge=%{CHAP-Challenge} ->
> -chap-challenge=
> [multiotp]     expand: -chap-password=%{CHAP-Password} -> -chap-password=
> [multiotp]     expand: -ms-chap-challenge=%{MS-CHAP-Challenge} ->
> -ms-chap-challenge=
> [multiotp]     expand: -ms-chap-response=%{MS-CHAP-Response} ->
> -ms-chap-response=
> [multiotp]     expand: -ms-chap2-response=%{MS-CHAP2-Response} ->
> -ms-chap2-response=
> Exec-Program output: Group-Name = "forbidden-users"
> Exec-Program-Wait: value-pairs: Group-Name = "forbidden-users"
> Exec-Program: returned: 0
> ++[multiotp] returns ok
> Login OK: [testuser] (from client localhost port 0)
> # Executing section post-auth from file
> /etc/freeradius/sites-enabled/default
> +- entering group post-auth {...}
> ++[exec] returns noop
> Sending Access-Accept of id 111 to 127.0.0.1 port 46615
>      Class = 0x656e61626c6564
>      Reply-Message = "Your multiotp-account has been enabled."
> Finished request 0.
> Going to the next request
> Waking up in 4.9 seconds.
>
>
> So, I think I am using the wrong attribute-keyword. Can anybody tell me,
> which keyword do I have to use?
>
> Regards,
> Stefan
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html