Re: Copying User-Name from inner tunnel to outer for accounting

--===============8990718197444548503==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_045885C6-71A7-41B5-8428-6096FA648E81";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_045885C6-71A7-41B5-8428-6096FA648E81
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On Jul 20, 2026, at 5:27=E2=80=AFPM, Dominik George via Freeradius-Users =
<[email protected]> wrote:
> I am trying to do accounting for a user that previously authenticated =
through RADIUS. I know that the best way would be to use cui and have =
the NAS send a properly hashed identifier in its Accounting-Request, but =
unfortunately, my NAS does not support re-using the User-Name from the =
Access-Response for accounting. It always sends the anomymous identity =
from EAP instead.

  Upgrade the NAS.  :(

> My idea was to save the authenticated user in the auth phase in inner =
tunnel, then extract this again when the accounting request comes in. =
However, I can't get this to work.

  Save it *where*?

> What I tried is to set
>=20
>  post-auth {
>    update outer.session-state {
>      User-Name :=3D "%{User-Name}"
>    }
>  }
>=20
> in inner tunnel, then
>=20
>  accounting {
>    update request {
>      User-Name :=3D "%{session-state:User-Name}"
>    }
>  }
>=20
> in the outer config. HOwever, it always is empty that way.

  Yes.  The session-state list is tracked only for Access-Request =
packets.

  If you want to store data across Access-Request to Accounting packets, =
put the information into a database.

> I verified that the NAS does correctly send the same Acct-Session-Id =
for both the auth ant the accounting requests, so FreeRADIUS should be =
able to correlate the state.

  The session-state list in FreeRADIUS has nothing to do with the =
Acct-Session-ID attribute.

> The accounting request will ultimately be forwarded using the REST =
module.
>=20
> Can anyone explain how I could get this to work?

  In post-auth, save the User-Name information in a database, keyed by =
Acct-Session-Id.  Then, update the "accounting" section to retrieve the =
User-Name from a database, keyed by Acct-Session-ID.

  Alan DeKok.


--Apple-Mail=_045885C6-71A7-41B5-8428-6096FA648E81
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmpeSLsACgkQv3SJ0h7d
TTOc7w//aNqpybYBybQvnTc93T2BCUf0CIB9g7vK53goYf4RTY9Gcv4yR0QhJZEy
E20ciqRN8UHoXG/DKgJG+b8QKl3txNbzLqjcDkhSpCBxQMppSnEr8+gaNhrKzBP/
N64z593iq09LETybyXx1or38Ndy66W/Hcz6A7B5ioZAddVrXH2bjf15vqvCuEo6Q
cNbbg65uITvSglGMIbE2GDBhXNxSFuk0IzIxJc1iu/rcydaFqtHeBHlhH8ytURKe
k2KAyw8I8yNDKtv2PS7T+DZYrjpIVESfFHJbnsar3QrYWICNgQKwOCcpiSqEm50H
Mm46XIyI1beW9M6lHwy+FnU0ZIb06mk3Nq8zxyPcHyxM/R0zTVu07N7uTt/eywve
WmXp7CyLoemSx/eOP+uwK0mg7bhynm4UsDybDNnto1lIDCDDu0lKzYGftqcLNmjm
b9UsFWPJeYxmX4s2RRKX5WudyWMLVaa905h14GCMU8snoIfFYcx5tEH9SruBJGf4
vXVQkFBxw9L+ArbCeYkup6VbgEKoGNj9KgmrrsEMGgVUctIJeaVgKw8euVB7ymMD
r0P/3BY/WcElxRy3TvxjmWPQpDKzIqAgQL23Lfs3xd7b6G2CxSol4A5JiHCCjo1X
9bgFeNEwHlnL8DSeeRGClgI7alO697IAI/y5s5id5gQLvvd2RnM=
=+NQP
-----END PGP SIGNATURE-----

--Apple-Mail=_045885C6-71A7-41B5-8428-6096FA648E81--

--===============8990718197444548503==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--===============8990718197444548503==--