(0) Received Access-Request Id 128 from 127.0.0.1:44258 to 127.0.0.1:1812 length 134
(0)   User-Name = "ldap_user"
(0)   NAS-IP-Address = 127.0.1.1
(0)   NAS-Port = 0
(0)   Message-Authenticator = 0xafcc15ee869b420b8170bf15d709e3af
(0)   MS-CHAP-Challenge = 0x7171f1b710bf77ee
(0)   MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000b919ae263270c00efb57064ec84b72a33be5376facd33519
(0) # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence
(0)   authorize {
(0)     policy packetfence-nas-ip-address {
(0)       if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){
(0)       if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE
(0)     } # policy packetfence-nas-ip-address = notfound
(0)     update {
(0)       EXPAND %{Packet-Src-IP-Address}
(0)          --> 127.0.0.1
(0)       &request:FreeRADIUS-Client-IP-Address := 127.0.0.1
(0)       EXPAND %{Packet-Dst-IP-Address}
(0)          --> 127.0.0.1
(0)       &request:PacketFence-Radius-Ip := 127.0.0.1
(0)       &control:PacketFence-RPC-Server = containers-gateway.internal
(0)       &control:PacketFence-RPC-Port = 7070
(0)       &control:PacketFence-RPC-User = system
(0)       &control:PacketFence-RPC-Pass = ZjVmM2YyODQ5NTU1NGE5NmU5ZWJkOTU3
(0)       &control:PacketFence-RPC-Proto = http
(0)       EXPAND %l
(0)          --> 1667251933
(0)       &control:Tmp-Integer-0 := 1667251933
(0)       &control:PacketFence-Request-Time := 0
(0)     } # update = noop
(0)     policy packetfence-set-realm-if-machine {
(0)       if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) {
(0)       if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i)  -> FALSE
(0)     } # policy packetfence-set-realm-if-machine = noop
(0)     policy packetfence-balanced-key-policy {
(0)       if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) {
(0)       if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i))  -> FALSE
(0)       else {
(0)         update {
(0)           EXPAND %{md5:%{Calling-Station-Id}%{User-Name}}
(0)              --> 1934ba9a62efd74276c9f7dc99fef249
(0)           &request:PacketFence-KeyBalanced := 1934ba9a62efd74276c9f7dc99fef249
(0)           EXPAND %{md5:%{Calling-Station-Id}%{User-Name}}
(0)              --> 1934ba9a62efd74276c9f7dc99fef249
(0)           &control:Load-Balance-Key := 1934ba9a62efd74276c9f7dc99fef249
(0)         } # update = noop
(0)       } # else = noop
(0)     } # policy packetfence-balanced-key-policy = noop
(0)     policy rewrite_calling_station_id {
(0)       if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {
(0)       if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy rewrite_calling_station_id = noop
(0)     policy rewrite_called_station_id {
(0)       if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {
(0)       if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i))  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy rewrite_called_station_id = noop
(0)     if ( "%{client:shortname}" =~ /eduroam_tlrs/ ) {
(0)     EXPAND %{client:shortname}
(0)        --> localhost
(0)     if ( "%{client:shortname}" =~ /eduroam_tlrs/ )  -> FALSE
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = noop
(0)     } # policy filter_username = noop
(0)     policy filter_password {
(0)       if (&User-Password && 	   (&User-Password != "%{string:User-Password}")) {
(0)       if (&User-Password && 	   (&User-Password != "%{string:User-Password}"))  -> FALSE
(0)     } # policy filter_password = noop
(0)     [preprocess] = ok
(0) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
(0)     [mschap] = ok
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "ldap_user", skipping NULL due to config.
(0)     [suffix] = noop
(0) ntdomain: Checking for prefix before "\"
(0) ntdomain: No '\' in User-Name = "ldap_user", looking up realm NULL
(0) ntdomain: Found realm "null"
(0) ntdomain: Adding Stripped-User-Name = "ldap_user"
(0) ntdomain: Adding Realm = "null"
(0) ntdomain: Authentication realm is LOCAL
(0)     [ntdomain] = ok
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
rlm_ldap (freeipa): 0 of 0 connections in use.  You  may need to increase "spare"
rlm_ldap (freeipa): Opening additional connection (0), 1 of 10 pending slots used
rlm_ldap (freeipa): Connecting to ldap://replica.dmosk.local:389
rlm_ldap (freeipa): Waiting for bind result...
rlm_ldap (freeipa): Bind successful
rlm_ldap (freeipa): Reserved connection (0)
(0) freeipa: EXPAND (&(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})))
(0) freeipa:    --> (&(|(uid=ldap_user)))
(0) freeipa: Performing search in "cn=users,cn=accounts,dc=21-school,dc=ru" with filter "(&(|(uid=ldap_user)))", scope "sub"
(0) freeipa: Waiting for search result...
(0) freeipa: User object found at DN "uid=ldap_user,cn=users,cn=accounts,dc=21-school,dc=ru"
(0) freeipa: Processing user attributes
(0) freeipa: control:NT-Password := 0xc09df3da52e199b97d9709f1438f153f
(0) freeipa: request:PacketFence-UserNameAttribute := "ldap_user"
rlm_ldap (freeipa): Released connection (0)
Need 4 more connections to reach min connections (5)
Need more connections to reach 3 spares
rlm_ldap (freeipa): Opening additional connection (1), 1 of 9 pending slots used
rlm_ldap (freeipa): Connecting to ldap://replica.dmosk.local:389
rlm_ldap (freeipa): Waiting for bind result...
rlm_ldap (freeipa): Bind successful
(0)     [freeipa] = updated
(0)     update control {
(0)       MS-CHAP-Use-NTLM-Auth := No
(0)     } # update control = noop
(0)     if ( !EAP-Message && "%{%{Control:Auth-type}:-No-MS_CHAP}" != "MS-CHAP") {
(0)     EXPAND %{%{Control:Auth-type}:-No-MS_CHAP}
(0)        --> MS-CHAP
(0)     if ( !EAP-Message && "%{%{Control:Auth-type}:-No-MS_CHAP}" != "MS-CHAP")  -> FALSE
(0)     if ("%{%{Control:Auth-type}:-No-MS_CHAP}" == "MS-CHAP") {
(0)     EXPAND %{%{Control:Auth-type}:-No-MS_CHAP}
(0)        --> MS-CHAP
(0)     if ("%{%{Control:Auth-type}:-No-MS_CHAP}" == "MS-CHAP")  -> TRUE
(0)     if ("%{%{Control:Auth-type}:-No-MS_CHAP}" == "MS-CHAP")  {
(0) packetfence-multi-domain:   $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'ldap_user'
(0) packetfence-multi-domain:   $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '127.0.1.1'
(0) packetfence-multi-domain:   $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '0'
(0) packetfence-multi-domain:   $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Nov  1 2022 00:32:13 MSK'
(0) packetfence-multi-domain:   $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0xafcc15ee869b420b8170bf15d709e3af'
(0) packetfence-multi-domain:   $RAD_REQUEST{'MS-CHAP-Response'} = &request:MS-CHAP-Response -> '0x0001000000000000000000000000000000000000000000000000b919ae263270c00efb57064ec84b72a33be5376facd33519'
(0) packetfence-multi-domain:   $RAD_REQUEST{'MS-CHAP-Challenge'} = &request:MS-CHAP-Challenge -> '0x7171f1b710bf77ee'
(0) packetfence-multi-domain:   $RAD_REQUEST{'Stripped-User-Name'} = &request:Stripped-User-Name -> 'ldap_user'
(0) packetfence-multi-domain:   $RAD_REQUEST{'Realm'} = &request:Realm -> 'null'
(0) packetfence-multi-domain:   $RAD_REQUEST{'FreeRADIUS-Client-IP-Address'} = &request:FreeRADIUS-Client-IP-Address -> '127.0.0.1'
(0) packetfence-multi-domain:   $RAD_REQUEST{'PacketFence-UserNameAttribute'} = &request:PacketFence-UserNameAttribute -> 'ldap_user'
(0) packetfence-multi-domain:   $RAD_REQUEST{'PacketFence-KeyBalanced'} = &request:PacketFence-KeyBalanced -> '1934ba9a62efd74276c9f7dc99fef249'
(0) packetfence-multi-domain:   $RAD_REQUEST{'PacketFence-Radius-Ip'} = &request:PacketFence-Radius-Ip -> '127.0.0.1'
(0) packetfence-multi-domain:   $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'MS-CHAP'
(0) packetfence-multi-domain:   $RAD_CHECK{'Load-Balance-Key'} = &control:Load-Balance-Key -> '1934ba9a62efd74276c9f7dc99fef249'
(0) packetfence-multi-domain:   $RAD_CHECK{'LDAP-UserDN'} = &control:LDAP-UserDN -> 'uid=ldap_user,cn=users,cn=accounts,dc=21-school,dc=ru'
(0) packetfence-multi-domain:   $RAD_CHECK{'NT-Password'} = &control:NT-Password -> '0xc09df3da52e199b97d9709f1438f153f'
(0) packetfence-multi-domain:   $RAD_CHECK{'MS-CHAP-Use-NTLM-Auth'} = &control:MS-CHAP-Use-NTLM-Auth -> 'No'
(0) packetfence-multi-domain:   $RAD_CHECK{'Tmp-Integer-0'} = &control:Tmp-Integer-0 -> '1667251933'
(0) packetfence-multi-domain:   $RAD_CHECK{'PacketFence-RPC-Server'} = &control:PacketFence-RPC-Server -> 'containers-gateway.internal'
(0) packetfence-multi-domain:   $RAD_CHECK{'PacketFence-RPC-Port'} = &control:PacketFence-RPC-Port -> '7070'
(0) packetfence-multi-domain:   $RAD_CHECK{'PacketFence-RPC-User'} = &control:PacketFence-RPC-User -> 'system'
(0) packetfence-multi-domain:   $RAD_CHECK{'PacketFence-RPC-Pass'} = &control:PacketFence-RPC-Pass -> 'ZjVmM2YyODQ5NTU1NGE5NmU5ZWJkOTU3'
(0) packetfence-multi-domain:   $RAD_CHECK{'PacketFence-RPC-Proto'} = &control:PacketFence-RPC-Proto -> 'http'
(0) packetfence-multi-domain:   $RAD_CHECK{'PacketFence-Request-Time'} = &control:PacketFence-Request-Time -> '0'
(0) packetfence-multi-domain:   $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'MS-CHAP'
(0) packetfence-multi-domain:   $RAD_CONFIG{'Load-Balance-Key'} = &control:Load-Balance-Key -> '1934ba9a62efd74276c9f7dc99fef249'
(0) packetfence-multi-domain:   $RAD_CONFIG{'LDAP-UserDN'} = &control:LDAP-UserDN -> 'uid=ldap_user,cn=users,cn=accounts,dc=21-school,dc=ru'
(0) packetfence-multi-domain:   $RAD_CONFIG{'NT-Password'} = &control:NT-Password -> '0xc09df3da52e199b97d9709f1438f153f'
(0) packetfence-multi-domain:   $RAD_CONFIG{'MS-CHAP-Use-NTLM-Auth'} = &control:MS-CHAP-Use-NTLM-Auth -> 'No'
(0) packetfence-multi-domain:   $RAD_CONFIG{'Tmp-Integer-0'} = &control:Tmp-Integer-0 -> '1667251933'
(0) packetfence-multi-domain:   $RAD_CONFIG{'PacketFence-RPC-Server'} = &control:PacketFence-RPC-Server -> 'containers-gateway.internal'
(0) packetfence-multi-domain:   $RAD_CONFIG{'PacketFence-RPC-Port'} = &control:PacketFence-RPC-Port -> '7070'
(0) packetfence-multi-domain:   $RAD_CONFIG{'PacketFence-RPC-User'} = &control:PacketFence-RPC-User -> 'system'
(0) packetfence-multi-domain:   $RAD_CONFIG{'PacketFence-RPC-Pass'} = &control:PacketFence-RPC-Pass -> 'ZjVmM2YyODQ5NTU1NGE5NmU5ZWJkOTU3'
(0) packetfence-multi-domain:   $RAD_CONFIG{'PacketFence-RPC-Proto'} = &control:PacketFence-RPC-Proto -> 'http'
(0) packetfence-multi-domain:   $RAD_CONFIG{'PacketFence-Request-Time'} = &control:PacketFence-Request-Time -> '0'
(0) packetfence-multi-domain: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '0'
(0) packetfence-multi-domain: &request:PacketFence-KeyBalanced = $RAD_REQUEST{'PacketFence-KeyBalanced'} -> '1934ba9a62efd74276c9f7dc99fef249'
(0) packetfence-multi-domain: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'ldap_user'
(0) packetfence-multi-domain: &request:PacketFence-UserNameAttribute = $RAD_REQUEST{'PacketFence-UserNameAttribute'} -> 'ldap_user'
(0) packetfence-multi-domain: &request:MS-CHAP-Response = $RAD_REQUEST{'MS-CHAP-Response'} -> '0x0001000000000000000000000000000000000000000000000000b919ae263270c00efb57064ec84b72a33be5376facd33519'
(0) packetfence-multi-domain: &request:FreeRADIUS-Client-IP-Address = $RAD_REQUEST{'FreeRADIUS-Client-IP-Address'} -> '127.0.0.1'
(0) packetfence-multi-domain: &request:PacketFence-NTLMv2-Only = $RAD_REQUEST{'PacketFence-NTLMv2-Only'} -> ''
(0) packetfence-multi-domain: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '127.0.1.1'
(0) packetfence-multi-domain: &request:MS-CHAP-Challenge = $RAD_REQUEST{'MS-CHAP-Challenge'} -> '0x7171f1b710bf77ee'
(0) packetfence-multi-domain: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0xafcc15ee869b420b8170bf15d709e3af'
(0) packetfence-multi-domain: &request:Realm = $RAD_REQUEST{'Realm'} -> 'null'
(0) packetfence-multi-domain: &request:PacketFence-Radius-Ip = $RAD_REQUEST{'PacketFence-Radius-Ip'} -> '127.0.0.1'
(0) packetfence-multi-domain: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Nov  1 2022 00:32:13 MSK'
(0) packetfence-multi-domain: &request:Stripped-User-Name = $RAD_REQUEST{'Stripped-User-Name'} -> 'ldap_user'
(0) packetfence-multi-domain: &control:PacketFence-Request-Time = $RAD_CHECK{'PacketFence-Request-Time'} -> '0'
(0) packetfence-multi-domain: &control:PacketFence-RPC-Proto = $RAD_CHECK{'PacketFence-RPC-Proto'} -> 'http'
(0) packetfence-multi-domain: &control:NT-Password = $RAD_CHECK{'NT-Password'} -> '0xc09df3da52e199b97d9709f1438f153f'
(0) packetfence-multi-domain: &control:MS-CHAP-Use-NTLM-Auth = $RAD_CHECK{'MS-CHAP-Use-NTLM-Auth'} -> 'No'
(0) packetfence-multi-domain: &control:Load-Balance-Key = $RAD_CHECK{'Load-Balance-Key'} -> '1934ba9a62efd74276c9f7dc99fef249'
(0) packetfence-multi-domain: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'MS-CHAP'
(0) packetfence-multi-domain: &control:PacketFence-RPC-Pass = $RAD_CHECK{'PacketFence-RPC-Pass'} -> 'ZjVmM2YyODQ5NTU1NGE5NmU5ZWJkOTU3'
(0) packetfence-multi-domain: &control:PacketFence-RPC-Port = $RAD_CHECK{'PacketFence-RPC-Port'} -> '7070'
(0) packetfence-multi-domain: &control:LDAP-UserDN = $RAD_CHECK{'LDAP-UserDN'} -> 'uid=ldap_user,cn=users,cn=accounts,dc=21-school,dc=ru'
(0) packetfence-multi-domain: &control:PacketFence-RPC-Server = $RAD_CHECK{'PacketFence-RPC-Server'} -> 'containers-gateway.internal'
(0) packetfence-multi-domain: &control:PacketFence-RPC-User = $RAD_CHECK{'PacketFence-RPC-User'} -> 'system'
(0) packetfence-multi-domain: &control:Tmp-Integer-0 = $RAD_CHECK{'Tmp-Integer-0'} -> '1667251933'
(0)       [packetfence-multi-domain] = updated
(0)     } # if ("%{%{Control:Auth-type}:-No-MS_CHAP}" == "MS-CHAP")  = updated
(0)     policy packetfence-eap-mac-policy {
(0)       if ( &EAP-Type ) {
(0)       if ( &EAP-Type )  -> FALSE
(0)       [noop] = noop
(0)     } # policy packetfence-eap-mac-policy = noop
(0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(0) pap: WARNING: !!! Ignoring control:User-Password.  Update your        !!!
(0) pap: WARNING: !!! configuration so that the "known good" clear text !!!
(0) pap: WARNING: !!! password is in Cleartext-Password and NOT in        !!!
(0) pap: WARNING: !!! User-Password.                                      !!!
(0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(0) pap: WARNING: Auth-Type already set.  Not setting to PAP
(0)     [pap] = noop
(0)   } # authorize = updated
(0) Found Auth-Type = MS-CHAP
(0) # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence
(0)   Auth-Type MS-CHAP {
(0)     if (NAS-Port-Type =~ /^Wireless/ || NAS-Port-Type =~ /^Ethernet/) {
(0)     ERROR: Failed retrieving values required to evaluate condition
(0)     else {
(0)       policy packetfence-mschap-authenticate {
(0)         if (PacketFence-Domain) {
(0)         if (PacketFence-Domain)  -> FALSE
(0)         else {
(0)           if ( "%{User-Name}" =~ /^host\/.*/) {
(0)           EXPAND %{User-Name}
(0)              --> ldap_user
(0)           if ( "%{User-Name}" =~ /^host\/.*/)  -> FALSE
(0)           else {
(0) mschap: Found NT-Password
(0) mschap: Client is using MS-CHAPv1 with NT-Password
(0) mschap: adding MS-CHAPv1 MPPE keys
(0)             [mschap] = ok
(0)           } # else = ok
(0)         } # else = ok
(0)       } # policy packetfence-mschap-authenticate = ok
(0)     } # else = ok
(0)   } # Auth-Type MS-CHAP = ok
(0) # Executing section post-auth from file /usr/local/pf/raddb/sites-enabled/packetfence
(0)   post-auth {
(0)     update {
(0)       EXPAND %{Packet-Src-IP-Address}
(0)          --> 127.0.0.1
(0)       &request:FreeRADIUS-Client-IP-Address := 127.0.0.1
(0)       EXPAND %{Packet-Dst-IP-Address}
(0)          --> 127.0.0.1
(0)       &request:PacketFence-Radius-Ip := 127.0.0.1
(0)       &control:PacketFence-RPC-Server = containers-gateway.internal
(0)       &control:PacketFence-RPC-Port = 7070
(0)       &control:PacketFence-RPC-User = system
(0)       &control:PacketFence-RPC-Pass = ZjVmM2YyODQ5NTU1NGE5NmU5ZWJkOTU3
(0)       &control:PacketFence-RPC-Proto = http
(0)     } # update = noop
(0)     if ("%{%{control:PacketFence-Proxied-From}:-False}" == "True") {
(0)     EXPAND %{%{control:PacketFence-Proxied-From}:-False}
(0)        --> False
(0)     if ("%{%{control:PacketFence-Proxied-From}:-False}" == "True")  -> FALSE
(0)     if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) ) {
(0)     if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) )  -> TRUE
(0)     if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) )  {
rlm_rest (rest): 0 of 0 connections in use.  You  may need to increase "spare"
rlm_rest (rest): Opening additional connection (0), 1 of 64 pending slots used
rlm_rest (rest): Connecting to "http://containers-gateway.internal:7070/"
rlm_rest (rest): Reserved connection (0)
(0) rest: Expanding URI components
(0) rest: EXPAND http://containers-gateway.internal:7070
(0) rest:    --> http://containers-gateway.internal:7070
(0) rest: EXPAND //radius/rest/authorize
(0) rest:    --> //radius/rest/authorize
(0) rest: Sending HTTP POST to "http://containers-gateway.internal:7070//radius/rest/authorize"
(0) rest: Encoding attribute "User-Name"
(0) rest: Encoding attribute "NAS-IP-Address"
(0) rest: Encoding attribute "NAS-Port"
(0) rest: Encoding attribute "Event-Timestamp"
(0) rest: Encoding attribute "Message-Authenticator"
(0) rest: Encoding attribute "MS-CHAP-Response"
(0) rest: Encoding attribute "MS-CHAP-Challenge"
(0) rest: Encoding attribute "Stripped-User-Name"
(0) rest: Encoding attribute "Realm"
(0) rest: Encoding attribute "Module-Failure-Message"
(0) rest: Encoding attribute "FreeRADIUS-Client-IP-Address"
(0) rest: Encoding attribute "PacketFence-UserNameAttribute"
(0) rest: Encoding attribute "PacketFence-KeyBalanced"
(0) rest: Encoding attribute "PacketFence-Radius-Ip"
(0) rest: Encoding attribute "PacketFence-NTLMv2-Only"
(0) rest: Processing response header
(0) rest:   Status : 401 (Unauthorized)
(0) rest:   Type   : json (application/json)
(0) rest: Adding reply:REST-HTTP-Status-Code = "401"
(0) rest: ERROR: Server returned:
(0) rest: ERROR: {"control:PacketFence-Authorization-Status":"allow"}
rlm_rest (rest): Released connection (0)
Need 2 more connections to reach min connections (3)
Need more connections to reach 10 spares
rlm_rest (rest): Opening additional connection (1), 1 of 63 pending slots used
rlm_rest (rest): Connecting to "http://containers-gateway.internal:7070/"
(0)       [rest] = invalid
(0)     } # if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) )  = invalid
(0)   } # post-auth = invalid
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence
(0)   Post-Auth-Type REJECT {
(0)     update {
(0)       &request:User-Password := "******"
(0)     } # update = noop
(0)     if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) ) {
(0)     if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) )  -> TRUE
(0)     if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) )  {
(0)       policy packetfence-audit-log-reject {
(0)         if (&User-Name && (&User-Name == "dummy")) {
(0)         if (&User-Name && (&User-Name == "dummy"))  -> FALSE
(0)         else {
(0)           policy request-timing {
(0)             if ("%{%{control:PacketFence-Request-Time}:-0}" != 0) {
(0)             EXPAND %{%{control:PacketFence-Request-Time}:-0}
(0)                --> 0
(0)             if ("%{%{control:PacketFence-Request-Time}:-0}" != 0)  -> FALSE
(0)           } # policy request-timing = noop
(0) sql_reject: EXPAND type.reject.query
(0) sql_reject:    --> type.reject.query
(0) sql_reject: Using query template 'query'
rlm_sql (sql): Reserved connection (0)
(0) sql_reject: EXPAND %{User-Name}
(0) sql_reject:    --> ldap_user
(0) sql_reject: SQL-User-Name set to 'ldap_user'
(0) sql_reject: EXPAND INSERT INTO radius_audit_log               ( mac, ip, computer_name, user_name,                stripped_user_name,  realm, event_type,                switch_id, switch_mac, switch_ip_address,                radius_source_ip_address, called_station_id, calling_station_id,                nas_port_type, ssid, nas_port_id,                ifindex, nas_port, connection_type,                nas_ip_address, nas_identifier, auth_status,                reason, auth_type, eap_type,                role, node_status, profile,                source, auto_reg, is_phone,                pf_domain, uuid, radius_request,                radius_reply, request_time, radius_ip)              VALUES               ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}',                '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request',                '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}',                '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}',                '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}',                '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}',                '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}',  'Reject',                 '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}',                '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}',                '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-0}', '%{%{control:PacketFence-IsPhone}:-0}',                '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-0}', '%{request:PacketFence-Radius-Ip}')
(0) sql_reject:    --> INSERT INTO radius_audit_log               ( mac, ip, computer_name, user_name,                stripped_user_name,  realm, event_type,                switch_id, switch_mac, switch_ip_address,                radius_source_ip_address, called_station_id, calling_station_id,                nas_port_type, ssid, nas_port_id,                ifindex, nas_port, connection_type,                nas_ip_address, nas_identifier, auth_status,                reason, auth_type, eap_type,                role, node_status, profile,                source, auto_reg, is_phone,                pf_domain, uuid, radius_request,                radius_reply, request_time, radius_ip)              VALUES               ( '', '', 'N/A', 'ldap_user',                'ldap_user', 'null', 'Radius-Access-Request',                'N/A', 'N/A', 'N/A',                '127.0.0.1', '', '',                '', '', '',                'N/A', '0', 'N/A',                '127.0.1.1', '',  'Reject',                 'Failed retrieving values required to evaluate condition', 'MS-CHAP', '',                'N/A', 'N/A', 'N/A',                'N/A', '0', '0',                '', '', 'User-Name =3D =22ldap_user=22, NAS-IP-Address =3D 127.0.1.1, NAS-Port =3D 0, Event-Timestamp =3D =22Nov  1 2022 00:32:13 MSK=22, Message-Authenticator =3D 0xafcc15ee869b420b8170bf15d709e3af, MS-CHAP-Response =3D 0x0001000000000000000000000000000000000000000000000000b919ae263270c00efb57064ec84b72a33be5376facd33519, MS-CHAP-Challenge =3D 0x7171f1b710bf77ee, Stripped-User-Name =3D =22ldap_user=22, Realm =3D =22null=22, Module-Failure-Message =3D =22Failed retrieving values required to evaluate condition=22, FreeRADIUS-Client-IP-Address =3D 127.0.0.1, PacketFence-UserNameAttribute =3D =22ldap_user=22, PacketFence-KeyBalanced =3D =221934ba9a62efd74276c9f7dc99fef249=22, PacketFence-Radius-Ip =3D =22127.0.0.1=22, PacketFence-NTLMv2-Only =3D =22=22, Module-Failure-Message =3D =22rest: Server returned:=22, Module-Failure-Message =3D =22rest: =7B=5C=22control:PacketFence-Authorization-Status=5C=22:=5C=22allow=5C=22=7D=22, User-Password =3D =22=2A=2A=2A=2A=2A=2A=22, SQL-User-Name =3D =22ldap_user=22','MS-CHAP-MPPE-Keys =3D 0x000000000000000022a23b023c283f7294223a6ef7863fce, MS-MPPE-Encryption-Policy =3D Encryption-Required, MS-MPPE-Encryption-Types =3D 4, REST-HTTP-Status-Code =3D 401', '0', '127.0.0.1')
(0) sql_reject: Executing query: INSERT INTO radius_audit_log               ( mac, ip, computer_name, user_name,                stripped_user_name,  realm, event_type,                switch_id, switch_mac, switch_ip_address,                radius_source_ip_address, called_station_id, calling_station_id,                nas_port_type, ssid, nas_port_id,                ifindex, nas_port, connection_type,                nas_ip_address, nas_identifier, auth_status,                reason, auth_type, eap_type,                role, node_status, profile,                source, auto_reg, is_phone,                pf_domain, uuid, radius_request,                radius_reply, request_time, radius_ip)              VALUES               ( '', '', 'N/A', 'ldap_user',                'ldap_user', 'null', 'Radius-Access-Request',                'N/A', 'N/A', 'N/A',                '127.0.0.1', '', '',                '', '', '',                'N/A', '0', 'N/A',                '127.0.1.1', '',  'Reject',                 'Failed retrieving values required to evaluate condition', 'MS-CHAP', '',                'N/A', 'N/A', 'N/A',                'N/A', '0', '0',                '', '', 'User-Name =3D =22ldap_user=22, NAS-IP-Address =3D 127.0.1.1, NAS-Port =3D 0, Event-Timestamp =3D =22Nov  1 2022 00:32:13 MSK=22, Message-Authenticator =3D 0xafcc15ee869b420b8170bf15d709e3af, MS-CHAP-Response =3D 0x0001000000000000000000000000000000000000000000000000b919ae263270c00efb57064ec84b72a33be5376facd33519, MS-CHAP-Challenge =3D 0x7171f1b710bf77ee, Stripped-User-Name =3D =22ldap_user=22, Realm =3D =22null=22, Module-Failure-Message =3D =22Failed retrieving values required to evaluate condition=22, FreeRADIUS-Client-IP-Address =3D 127.0.0.1, PacketFence-UserNameAttribute =3D =22ldap_user=22, PacketFence-KeyBalanced =3D =221934ba9a62efd74276c9f7dc99fef249=22, PacketFence-Radius-Ip =3D =22127.0.0.1=22, PacketFence-NTLMv2-Only =3D =22=22, Module-Failure-Message =3D =22rest: Server returned:=22, Module-Failure-Message =3D =22rest: =7B=5C=22control:PacketFence-Authorization-Status=5C=22:=5C=22allow=5C=22=7D=22, User-Password =3D =22=2A=2A=2A=2A=2A=2A=22, SQL-User-Name =3D =22ldap_user=22','MS-CHAP-MPPE-Keys =3D 0x000000000000000022a23b023c283f7294223a6ef7863fce, MS-MPPE-Encryption-Policy =3D Encryption-Required, MS-MPPE-Encryption-Types =3D 4, REST-HTTP-Status-Code =3D 401', '0', '127.0.0.1')
(0) sql_reject: SQL query returned: success
(0) sql_reject: 1 record(s) updated
rlm_sql (sql): Released connection (0)
Need 1 more connections to reach min connections (3)
Need more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (2), 1 of 62 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 10.5.15-MariaDB-1:10.5.15+maria~bullseye, protocol version 10
(0)           [sql_reject] = ok
(0)         } # else = ok
(0)       } # policy packetfence-audit-log-reject = ok
(0)     } # if (! EAP-Type || (EAP-Type != TTLS  && EAP-Type != PEAP) )  = ok
(0)     if ("%{%{control:PacketFence-Proxied-From}:-False}" == "True") {
(0)     EXPAND %{%{control:PacketFence-Proxied-From}:-False}
(0)        --> False
(0)     if ("%{%{control:PacketFence-Proxied-From}:-False}" == "True")  -> FALSE
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> ldap_user
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0) attr_filter.packetfence_post_auth: EXPAND %{User-Name}
(0) attr_filter.packetfence_post_auth:    --> ldap_user
(0) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10
(0)     [attr_filter.packetfence_post_auth] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default}
(0) linelog:    --> messages.Access-Reject
(0) linelog: EXPAND [mac:%{Calling-Station-Id}] Rejected user: %{User-Name}
(0) linelog:    --> [mac:] Rejected user: ldap_user
(0) linelog: EXPAND stdout
(0) linelog:    --> stdout
(0)     [linelog] = ok
(0)   } # Post-Auth-Type REJECT = updated
(0) Rejected in post-auth: [ldap_user] (from client localhost port 0)
(0) Login incorrect (Failed retrieving values required to evaluate condition): [ldap_user] (from client localhost port 0)
(0) Delaying response for 1.000000 seconds
Thread 1 waiting to be assigned a request
Waking up in 0.7 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 128 from 127.0.0.1:1812 to 127.0.0.1:44258 length 20
Waking up in 3.9 seconds.