Hi, > On 24/05/11 15:23, Martin Goldstone wrote: > > > Yes, I have this in both the peap stanza and the ttls stanza. This > > seems to be fine when access is accepted, for example if I set a > > Reply-Message saying "Welcome" in the post-auth section of the > > inner-tunnel config, I see this in the final access-accept message. > > Also, the output from freeradius -X suggests that (in the case of a user > > rejection) it gets the reply from the tunnel and that tunneled > > Ah, damn... > > I've just remembered - the PEAP code doesn't save the attributes on > reject :o( > > As you mentioned in your original email, the outer tunnel code doesn't > have any of the "useful" info so can only set a generic message.
....For EAP methods with tunneled authentication sessions (i.e. PEAP and EAP-TTLS), the inner tunnel session can also reference "outer.request", "outer.reply", and "outer.control". Those references allow you to address the relevant list in the outer tunnel session. so, in inner-tunnel post-auth, set "outer.reply" to be whatever you want.. you can then, in the outer layer, query/check or use that reply. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
