On 25/6/09 14:53, Arran Cudbard-Bell wrote:
On 25/6/09 12:01, a.l.m.bu...@lboro.ac.uk wrote:
Hi,
I leave you guys alone for 5 minutes....
8-) as i said, theres probably a way of doing it
*sigh* the Coffee excuse doesn't work past lunch time does it... (missed out
some curly braces)
instantiate {
sql_old
}
authorize {
# Retrieves credentials
sql_new
# Sets auth-type mschap
mschap
}
authenticate {
Auth-Type MS-CHAP {
mschap {
reject = 2
}
if(reject){
# Could alternatively write the value of a custom
attribute into Cleartext-password
# if both old and new passwords were returned in the
call to sql* in authorize.
update control {
Cleartext-Password := "%{sql_old:SELECT<cleartext
password query...>}"
}
# Stop users logging in with null password (if there's
no 'old' password set)
if("%{control:Cleartext-Password}" == ''){
reject
}
# Remove stale password hashes created on first call to
rlm_mschap
update control {
NT-Password -= "%{control:NT-Password}"
LM-Password -= "%{control:LM-Password}"
}
mschap
}
}
}
--
Arran Cudbard-Bell (a.cudbard-b...@sussex.ac.uk),
Authentication, Authorisation and Accounting Officer,
Infrastructure Services (IT Services),
E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT
DDI+FAX: +44 1273 873900 | INT: 3900
GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
