Masquerading MSCHAPv2 User-Name?

[David Herselman]

Hi Alan,

Changing the key in mods-enabled/files unfortunately results in the group checks then failing. It appears 'Group ==' checks require 'User-Name' to be set. Is this possibly a bug?

(1) files: EXPAND %{%{sAMAccountName}:-%{%{Stripped-User-Name}:-%{User-Name}}}
(1) files:    --> davidh
(1) files: Failed resolving UID: No error
(1) files: Failed resolving UID: No error
(1) files: Failed resolving UID: No error
(1) files: Failed resolving UID: No error
(1) files: users: Matched entry DEFAULT at line 295
(1)     [files] = ok
<snip>
(1) Found Auth-Type = Reject


I had updated key as follows:
    key = "%{%{sAMAccountName}:-%{%{Stripped-User-Name}:-%{User-Name}}}"


If I restore the key statement and amend sites-available/default back to the following it works again:
    if (&sAMAccountName) {update request {User-Name := "%{sAMAccountName}"}}
    files
    if (&sAMAccountName) {update request {User-Name := "%{Yubikey-OTP}"}}

(1) files: users: Matched entry DEFAULT at line 288
(1)     [files] = ok


My rlm_files authorize content:
DEFAULT FreeRADIUS-Client-Shortname == "clients-subnet", Group == "routers_clients_view"
        Mikrotik-Group = "view"
DEFAULT FreeRADIUS-Client-Shortname == "clients-subnet", Group == "routers_clients_restricted"
        Mikrotik-Group = "restricted"
DEFAULT FreeRADIUS-Client-Shortname == "clients-subnet", Group == "routers_clients_nms"
        Mikrotik-Group = "view"
DEFAULT FreeRADIUS-Client-Shortname == "clients-subnet", Group == "routers_clients_full"
        Mikrotik-Group = "full"
DEFAULT FreeRADIUS-Client-Shortname == "clients-subnet", Auth-Type := Reject


Regards
David Herselman

-----Original Message-----

>    if (&sAMAccountName) {update request {User-Name := "%{sAMAccountName}"}}files

  I really don't recommend changing User-Name.  It is very likely to break all kinds of things.
  What you can do is edit mods-enabled/files, and change the key used to look up entries.  Use:
	key = %{%{sAMAccountName}:-%{User-Name}}