tygozwolle/radius
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: implement RadiusService for guest registration, session management, and usage tracking with AccountEnforcementService support.
Build and Push Docker Image to Gitea Container Registry / build-and-push (push) Successful in 2m21s
Details
Build and Push Docker Image to Gitea Container Registry / build-and-push (pull_request) Successful in 1m38s
Details

Browse Source
This commit is contained in:
Tygozwolle
2026-07-24 20:33:08 +02:00
parent 87d6d7e764
commit 3b20b7481e
2 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
radiuscontroller/Services/AccountEnforcementService.cs
+12 -11
View File
@@ -87,19 +87,20 @@ public class AccountEnforcementService : BackgroundService
// Disable the account
profile.Status = "Expired";
// Scramble the password so the device prompts for new credentials
var check = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password", ct);
if (check != null)
{
check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
}
// Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
var checks = await db.RadCheck
.Where(rc => rc.Username == profile.Username)
.ToListAsync(ct);
db.RadCheck.RemoveRange(checks);
// Cleanup any old Auth-Type Reject entries
var rejectCheck = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type", ct);
if (rejectCheck != null)
// Insert Auth-Type := Reject to explicitly deny
db.RadCheck.Add(new RadCheck
{
db.RadCheck.Remove(rejectCheck);
}
Username = profile.Username,
Attribute = "Auth-Type",
Op = ":=",
Value = "Reject"
});
_logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);
radiuscontroller/Services/RadiusService.cs
+10 -11
View File
@@ -272,18 +272,17 @@ public class RadiusService : IRadiusService
profile.Status = "Revoked";
// Scramble the password instead of Auth-Type := Reject so devices prompt for new credentials
var check = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password");
if (check != null)
{
check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
}
// Remove Cleartext-Password and insert Auth-Type := Reject
var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
_db.RadCheck.RemoveRange(checks);
var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");
if (rejectCheck != null)
_db.RadCheck.Add(new RadCheck
{
_db.RadCheck.Remove(rejectCheck);
}
Username = profile.Username,
Attribute = "Auth-Type",
Op = ":=",
Value = "Reject"
});
await _db.SaveChangesAsync();
@@ -332,7 +331,7 @@ public class RadiusService : IRadiusService
});
}
if (profile.Status == "Revoked" || profile.Status == "Expired")
if (profile.Status == "Revoked")
{
profile.Status = "Active";
var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");