6.9.2 Verifying Active Sessions

Whatever database radiusd uses, an open entry in it does not necessary mean that the corresponding session is still being active. So, after retrieving the information about user sessions, Radius verifies on corresponding NASes whether these are actually active.

For each entry in the session list, if its NAS acknowledges the session, the session count is incremented. Otherwise, such entry is marked as closed in the database and is not counted.

There may also be cases when the NAS is unreachable due to some reasons. In such cases the Radius behavior is determined by the value of checkrad-assume-logged in ‘config’ file auth statement (raddb/config). If the value is yes, Radius assumes the session is still active and increases the session count, otherwise it proceeds as if the NAS returned negative reply.

To query a NAS, Radius first looks up its type and additional parameters in ‘naslist’ file (see section NAS List — ‘raddb/naslist’). There are two predefined NAS types that cause Radius to act immediately without querying tne NAS: the special type ‘true’ forces Radius to act as if the NAS returned 1, the type ‘false’ forces it to act as if the NAS returned 0. If the type is neither of this predefined types, Radius uses it as a look up key into the ‘nastypes’ file (see section NAS Types — ‘raddb/nastypes’) and tries to retrieve an entry which has matching type. If such entry does not exist, Radius issues the error message and acts accordingly to the value of configuration variable checkrad-assume-logged. Otherwise, Radius determines the query method to use from the second field of this entry, and constructs method arguments by appending arguments from the ‘naslist’ entry to those of nastypes entry. Note, that the former take precedence over the latter, and can thus be used to override default values specified in ‘nastypes’.

Having determined the query method and its argument, Radius queries NAS and analyzes its output by invoking a user-supplied Rewrite function. The function to use is specified by the function= argument to the method. It is called each time a line of output is received from the NAS (for finger queries) or a variable is received (for SNMP queries). The process continues until the function returns 1 or the last line of output is read or a timeout occurs whichever comes first.

If the user-function returns 1 it is taken to mean the user's session is now active at the NAS, otherwise, if it replies 0 or if the end of output is reached, it is taken to mean the user's session is not active.

The syntax conventions for user-supplied functions are described in detail in Login Verification Functions.

This document was generated by Sergey Poznyakoff on December, 6 2008 using texi2html 1.78.