Cannot get the return code of rlm_krb5

[Alan DeKok]

On Mar 30, 2017, at 4:07 AM, LAUDREN Olivier <olivier.laudren at ext.europarl.europa.eu> wrote:
> 
> I am using FreeRADIUS v3.0.4

  You should really upgrade.

> on Red Hat Enterprise Linux Server release 7.2 (Maipo), the authenticate section is below;
> 	authenticate {
> 		Auth-Type Kerberos {
> 			krb5
> 			update control {
> 				Reason := "%{Module-Return-Code}"
> 			}
> 		}
> 	}
> 
> The attribute gets the correct value except (at least) for the "fail" and the "invalid" return codes.
> According to the document;
...
> The "fail" should be taken into account but it looks like the action table is as the authorize one below;

  Yes, that is used for sub-sections in authenticate, i.e. blocks wishing "Auth-Type" section.

> I have tried to override as shown on this page with no success;

  What does that mean?

> Any idea of how I could get the actual result from rlm_krb5 module?

  The result is returned and handled as with anything else.

  Alan DeKok.