Check local before LDAP Authentication

[Matteo Raffa]

>  It doesn't save a variable for each possible module.  That would be an enormous amount of work, and isn't that useful.

Thanks for pointing that out, I wasn’t sure about that as I couldn’t find any reference on man pages.

>  You can just change the order of the modules in the configuration files.
> 
>  It might be better to explain what you're trying to do, instead of asking "why doesn't the server save each modules return code".
> 
>  i.e. don't ask why a particular solution doesn't work.  Explain the problem, and let us suggest a solution that works.

I’m sorry, I just put that in the subject and didn’t repeat it in the text.
What I want to achieve is quite simple: authenticate with LDAP only in case there’s no corresponding local user available.

In the meanwhile I came up with this.
I guess in case someone needs to check local users *after* ldap, it’d simply move the files module after ldap and before pap (without the additional condition check on files rcode). Am I right?


	files
	if (ok) {
    		pap
	}

	-ldap
	if ((ok || updated) && User-Password) {
    		update control {
        		Auth-Type := ldap
    		}
	}
	pap




> Hi Matteo,
> 
> First of all, its hard to help you without the debug logs, please https://wiki.freeradius.org/guide/radiusd-X <https://wiki.freeradius.org/guide/radiusd-X>
> 
> Other than that, please take a look at https://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO <https://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO> if you’re looking for AD or just take a look at /etc/raddb/mods-available/ldap. Then, back to us with some debug output.



Hello Jorge,
Thank you, but I already got LDAP authentication working.
I am just trying to understand which is the best way to implement this additional “emergency” local auth.