Actually, probably nicer to understand, and easier to look at if you clean it
up like this:
# configure AuthSQL
<AuthBy GROUP>
Identifier AuthSQL
<AuthBy SQL>
GroupMembershipQuery SELECT groupname FROM v_usergroups
WHERE username=%0 AND groupname=%1
AuthSelect select PASSWORD, 'Auth-Type=AuthHOTP',
'GroupList="Group1 Group2 Group3"' from SUBSCRIBERS where USERNAME=%0
AuthColumnDef 0, Class, request
AuthColumnDef 1, GENERIC, check
AuthColumnDef 2, GENERIC, check
</AuthBy>
</AuthBy GROUP>
# configure AuthHOTP
<AuthBy GROUP>
Identifier AuthHOTP
<AuthBy SQLHOTP>
...
</AuthBy>
</AuthBy GROUP>
# configure authentication process
<Realm DEFAULT>
AuthByPolicy ContinueWhileAccept
AuthBy AuthSQL
AuthBy AuthHOTP
</Realm>
On 11-02-03 02:43 PM, Michael wrote:
>
> your "AuthBy GROUP AuthSQL" will not flow down into the "AuthBy GROUP
> AuthHOTP". I don't think the AuthHOTP will be used at all in this config.
>
> Look like you need an "AuthBy AuthHOTP" in the AuthSQL config, like this:
>> <AuthBy GROUP>
>> Identifier AuthSQL
>> AuthByPolicy ContinueWhileAccept
>> <AuthBy SQL>
>> GroupMembershipQuery SELECT groupname FROM v_usergroups
>> WHERE username=%0 AND groupname=%1
>> AuthSelect select PASSWORD, 'Auth-Type=AuthHOTP',
>> 'GroupList="Group1 Group2 Group3"' from SUBSCRIBERS where USERNAME=%0
>> AuthColumnDef 0, Class, request
>> AuthColumnDef 1, GENERIC, check
>> AuthColumnDef 2, GENERIC, check
>> </AuthBy>
>
> # now call the AuthHOTP
> AuthBy AuthHOTP
>
>> </AuthBy GROUP>
>
>
> Michael
>
>
> On 11-02-03 02:34 PM, Linuxchuck wrote:
>> Hello again,
>>
>> I am attempting to validate both the username and appropriate group
>> membership via MySQL on an incoming access-request before bothering to
>> process the HOTP password provided. If the username doesn't exist, or the
>> user is not a member of the group in the list provided, send a reject and
>> stop processing.
>>
>> The problem I run into is that the grouplist check appears to be performed
>> by the 2nd AuthBy clause, which fails because HOTP is not capable of
>> checking groups. I would like for the group check to occur prior to the
>> HOTP check.
>>
>> Here is my config layout so far:
>>
>> FYI: The user entry in MySQL provides a check-item of "Auth-Type=AuthHOTP"
>>
>> <AuthBy GROUP>
>> Identifier AuthSQL
>> AuthByPolicy ContinueWhileAccept
>> <AuthBy SQL>
>> GroupMembershipQuery SELECT groupname FROM v_usergroups
>> WHERE username=%0 AND groupname=%1
>> AuthSelect select PASSWORD, 'Auth-Type=AuthHOTP',
>> 'GroupList="Group1 Group2 Group3"' from SUBSCRIBERS where USERNAME=%0
>> AuthColumnDef 0, Class, request
>> AuthColumnDef 1, GENERIC, check
>> AuthColumnDef 2, GENERIC, check
>> </AuthBy>
>> </AuthBy GROUP>
>>
>> <AuthBy GROUP>
>> Identifier AuthHOTP
>> <AuthBy SQLHOTP>
>> ...
>> </AuthBy>
>> </AuthBy GROUP>
>>
>> <Realm DEFAULT>
>> AuthBy AuthSQL
>> </Realm>
>>
>> I don't see any evidence that the Authby SQL is performing the group check,
>> and the log tells me "WARNING: This AuthBy does not know how to get user
>> Groups" under the HOTP section.
>>
>> Is there a way to accomplish what I'm after?
>>
>> Thanks!
>>
>> Chuck
>> _______________________________________________
>> radiator mailing list
>> radiator@open.com.au
>> http://www.open.com.au/mailman/listinfo/radiator
>>
>>
> _______________________________________________
> radiator mailing list
> radiator@open.com.au
> http://www.open.com.au/mailman/listinfo/radiator
>
>
_______________________________________________
radiator mailing list
radiator@open.com.au
http://www.open.com.au/mailman/listinfo/radiator
