post-auth configuration

[Dom Latter]

On 13/06/18 12:35, Alan DeKok wrote:
> On Jun 12, 2018, at 5:46 AM, Dom Latter <freeradius-users at latter.org> wrote:
>>   Seems a bit counter-
>> intuitive; what I would expect is the main section to apply to both ACCEPTs and REJECTs and then subsections to be applied additionally
>> where appropriate.  So just wondering what the rationale is.
> 
>    Why would you expect that?

Because every single programming language or bit of software I have EVER
worked with, if there's a *sub*-section then it is performed in
*addition* to whatever is in the main section.

So I was wondering why freeradius differs from the norm.

>    The server works as documented.  If your expectations are different from that, then they're wrong.
> 
>    i.e. READ the comments in the configuration you're editing.  They explain how the server works.  They should correct any misconceptions you have.

You mean this?

#  Access-Reject packets are sent through the REJECT sub-section of the
#  post-auth section.


That may be clear to you but coupled with an expectation of normality it
is not clear at all that Reject packets will *not* go through the main
part of the post-auth section.