Active Directory and Calling-Station-Id

[Ethariel]

Thks for the examples. This is clearer than the docs I've read before.
Now I've got it.


2017-02-23 9:51 GMT+01:00 Brian Candler <b.candler at pobox.com>:
> On 22/02/2017 18:20, Ethariel wrote:
>>
>> I indeed think I don't really get the difference between := and ==.
>> I've read several examples and doc but not so sure.
>
>
> := is an assignment operator (*set* an attribute). Other ones include "=",
> "+="
>
> == is a test operator (*compare* an attribute). Other ones include "!=",
> "=*"
>
> They can be mixed on the same line.  If all the tests pass, then all the
> assignments are done (*), including assignments to the reply list.
>
> So given an entry like this:
>
> foo Attr1 == "val1", Attr2 == "val2", Attr3 := "val3", Attr4 := "val4"
>     Attr5 := "val5"
>     Attr6 := "val6"
>
> the logic is essentially this:
>
> if (&request:User-Name == "foo" && &request:Attr1 == "val1" &&
> &request:Attr2 == "val2") {
>   update control {
>     &Attr3 := "val3"
>     &Attr4 := "val4"
>   }
>   update reply {
>     &Attr5 := "val5"
>     &Attr6 := "val6"
>   }
> }
>
> Now, a basic local password entry looks like this:
>
> customer1  Cleartext-Password := "xyzzy"
>
> What you need to realise is, this is *not* comparing the password.  This
> says "if the username is customer1, then *set* the Cleartext-Password
> attribute on the control list to be "xyzzy", and continue".
>
> Later, when the radius server gets to the authenticate {} section of the
> config, the authentication module will check that the credentials supplied
> by the user (in the incoming RADIUS request) are consistent with the
> Cleartext-Password that has been put on the control list.  In the case of
> PAP this just means checking that the supplied password and the
> Cleartext-Password are the same; but other authentication methods like CHAP
> work differently.
>
> The same applies if you write:
>
> customer1  Cleartext-Password = "xyzzy"
>
> It's still an assignment, not a check.  The difference between the ":=" and
> "=" assignment operators is that ":=" will replace any existing value of the
> given attribute, while "=" will only set the attribute if it doesn't already
> exist.
>
> Documentation:
> http://freeradius.org/radiusd/man/users.html
> http://freeradius.org/radiusd/man/rlm_files.html
>
> Regards,
>
> Brian.
>
> (*) I'm not entirely sure what happens if you mix check and control update
> items on the first line.  Safest to put all the check items first, and the
> update items afterwards.