feat: implement RadiusService for guest registration, session management, and usage tracking with AccountEnforcementService support.

2026-07-24 20:33:08 +02:00
parent 87d6d7e764
commit 3b20b7481e
2 changed files with 22 additions and 22 deletions
@@ -87,19 +87,20 @@ public class AccountEnforcementService : BackgroundService
                // Disable the account
                profile.Status = "Expired";

-                // Scramble the password so the device prompts for new credentials
-                var check = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password", ct);
-                if (check != null)
-                {
-                    check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
-                }
+                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
+                var checks = await db.RadCheck
+                    .Where(rc => rc.Username == profile.Username)
+                    .ToListAsync(ct);
+                db.RadCheck.RemoveRange(checks);

-                // Cleanup any old Auth-Type Reject entries
-                var rejectCheck = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type", ct);
-                if (rejectCheck != null)
+                // Insert Auth-Type := Reject to explicitly deny
+                db.RadCheck.Add(new RadCheck
                {
-                    db.RadCheck.Remove(rejectCheck);
-                }
+                    Username = profile.Username,
+                    Attribute = "Auth-Type",
+                    Op = ":=",
+                    Value = "Reject"
+                });

                _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);