I recently setup a freeradius 2 server with MySQL and I am having an issue where it doesn't appear to be doing group checks.

If I have a user set to a group it doesn't appear to check the attributes set in that group:

+----+----------+--------------+----+------------------------------------------+
| id | username | attribute | op | value |
+----+----------+--------------+----+------------------------------------------+
| 15 | user1 | SHA-Password | := | 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 |
+----+----------+--------------+----+------------------------------------------+
1 row in set (0.00 sec)

mysql> select * from radusergroup where username = 'user1';
+----------+-----------+----------+
| username | groupname | priority |
+----------+-----------+----------+
| user1 | admin | 1 |
+----------+-----------+----------+
1 row in set (0.00 sec)

mysql> select * from radgroupcheck where groupname = 'admin';
+----+-----------+----------------+----+--------+
| id | groupname | attribute | op | value |
+----+-----------+----------------+----+--------+
| 3 | admin | NAS-Identifier | == | Adtran |
+----+-----------+----------------+----+--------+
1 row in set (0.00 sec)


If I understand correctly the following request should be denied because the NAS-Identifier in the request doesn't match the one specified in the groupcheck table. However, it is replying with Accept-Accept.



rad_recv: Access-Request packet from host 64.185.12.105 port 7458, id=61, length=56
User-Name = "user1"
User-Password = "password"
NAS-Identifier = "Zhone MxK"
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
rlm_realm: No '@' in User-Name = "user1", looking up realm NULL
rlm_realm: No such realm "NULL"
++[suffix] returns noop
rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns notfound
++[files] returns noop
expand: %{User-Name} -> user1
rlm_sql (sql): sql_set_user escaped user --> 'user1'
rlm_sql (sql): Reserving sql socket id: 3
expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user1' ORDER BY id
rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user1' ORDER BY id
rlm_sql (sql): User found in radcheck table
expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user1' ORDER BY id
rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user1' ORDER BY id
expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user1' ORDER BY priority
rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'user1' ORDER BY priority
expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id
rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
rlm_pap: Normalizing SHA-Password from hex encoding
++[pap] returns updated
rad_check_password: Found Auth-Type
auth: type "PAP"
+- entering group PAP
rlm_pap: login attempt with password "password"
rlm_pap: Using SHA1 encryption.
rlm_pap: User authenticated successfully
++[pap] returns ok
Login OK: [user1/password] (from client lab-mxk-1 port 0)
+- entering group post-auth
rlm_sql (sql): Processing sql_postauth
expand: %{User-Name} -> user1
rlm_sql (sql): sql_set_user escaped user --> 'user1'
expand: %{User-Password} -> password
expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user1', 'password', 'Access-Accept', '2010-02-24 10:56:24')
expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user1', 'password', 'Access-Accept', '2010-02-24 10:56:24')
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user1', 'password', 'Access-Accept', '2010-02-24 10:56:24')
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
++[exec] returns noop
Sending Access-Accept of id 61 to 64.185.12.105 port 7458
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 61 with timestamp +9
Ready to process requests.


Any help would be greatly appreciated.

Thanks,
Craig