Active Directory and Calling-Station-Id

[Brian Candler]

On 22/02/2017 18:20, Ethariel wrote:
> I indeed think I don't really get the difference between := and ==.
> I've read several examples and doc but not so sure.

:= is an assignment operator (*set* an attribute). Other ones include 
"=", "+="

== is a test operator (*compare* an attribute). Other ones include "!=", 
"=*"

They can be mixed on the same line.  If all the tests pass, then all the 
assignments are done (*), including assignments to the reply list.

So given an entry like this:

foo Attr1 == "val1", Attr2 == "val2", Attr3 := "val3", Attr4 := "val4"
     Attr5 := "val5"
     Attr6 := "val6"

the logic is essentially this:

if (&request:User-Name == "foo" && &request:Attr1 == "val1" && 
&request:Attr2 == "val2") {
   update control {
     &Attr3 := "val3"
     &Attr4 := "val4"
   }
   update reply {
     &Attr5 := "val5"
     &Attr6 := "val6"
   }
}

Now, a basic local password entry looks like this:

customer1  Cleartext-Password := "xyzzy"

What you need to realise is, this is *not* comparing the password.  This 
says "if the username is customer1, then *set* the Cleartext-Password 
attribute on the control list to be "xyzzy", and continue".

Later, when the radius server gets to the authenticate {} section of the 
config, the authentication module will check that the credentials 
supplied by the user (in the incoming RADIUS request) are consistent 
with the Cleartext-Password that has been put on the control list.  In 
the case of PAP this just means checking that the supplied password and 
the Cleartext-Password are the same; but other authentication methods 
like CHAP work differently.

The same applies if you write:

customer1  Cleartext-Password = "xyzzy"

It's still an assignment, not a check.  The difference between the ":=" 
and "=" assignment operators is that ":=" will replace any existing 
value of the given attribute, while "=" will only set the attribute if 
it doesn't already exist.

Documentation:
http://freeradius.org/radiusd/man/users.html
http://freeradius.org/radiusd/man/rlm_files.html

Regards,

Brian.

(*) I'm not entirely sure what happens if you mix check and control 
update items on the first line.  Safest to put all the check items 
first, and the update items afterwards.