User and group attributes

Alan DeKok aland at
Wed Feb 26 19:37:36 CET 2014

Lorenzo Milesi wrote:
> I know it's a stupid question but so far I couldn't manage to dig it out.

  The answer should be in the debug output.

> I'm using FR2 with MySQL backend. All my users belong to one or more group. I usually set the Idle-Timeout attribute using the radgroupreply table, and it works great. For a minority of users I'd like to override this attribute to a different value, but I cannot have FR reply as I wish. 
> Current situation:
> Radcheck:
> USERA MD5-Password	:=	somemd5hash
> Radusergroup:
> USERA c_gvt	30
> Radgroupreply
> c_gvt	Idle-Timeout	:=	3800
> This works fine and replies 3800.


> If I add 
> USERA	Idle-Timeout	:=	100
> to radreply it will still reply 3800.

  Because the radusergroup checks are done AFTER the radreply checks.
This is visible in the debug output.

> Then I checked manpage of USERS [1] so I changed:
> Radreply:
> USERA	Idle-Timeout	:=	100
> Radgroupreply
> c_gvt	Idle-Timeout	=	3800
> but the reply is always the same.
> What am I missing?

  That should work.  What does the debug output say?

  Alan DeKok.

More information about the Freeradius-Users mailing list