feat: implement automated account enforcement service with RADIUS disconnect capabilities and add RADIUS management service

2026-07-24 20:29:11 +02:00
parent d88e03ea09
commit 87d6d7e764
2 changed files with 24 additions and 24 deletions
@@ -87,20 +87,19 @@ public class AccountEnforcementService : BackgroundService
                // Disable the account
                profile.Status = "Expired";

-                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
-                var checks = await db.RadCheck
-                    .Where(rc => rc.Username == profile.Username)
-                    .ToListAsync(ct);
-                db.RadCheck.RemoveRange(checks);
-
-                // Insert Auth-Type := Reject to explicitly deny
-                db.RadCheck.Add(new RadCheck
+                // Scramble the password so the device prompts for new credentials
+                var check = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password", ct);
+                if (check != null)
                {
-                    Username = profile.Username,
-                    Attribute = "Auth-Type",
-                    Op = ":=",
-                    Value = "Reject"
-                });
+                    check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
+                }
+
+                // Cleanup any old Auth-Type Reject entries
+                var rejectCheck = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type", ct);
+                if (rejectCheck != null)
+                {
+                    db.RadCheck.Remove(rejectCheck);
+                }

                _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);