feat: implement account enforcement background service and RADIUS disconnect support for expired sessions

2026-07-27 12:13:02 +02:00
parent cc04d8abea
commit bf261923e2
3 changed files with 10 additions and 19 deletions
@@ -87,19 +87,20 @@ public class AccountEnforcementService : BackgroundService
                // Disable the account
                profile.Status = "Expired";

-                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
+                // Replace password with a zeroed NT-Password hash so mschap runs
+                // but always fails — returns MS-CHAP-Error E=691, prompting iOS
+                // to show "Incorrect Password" instead of "Unable to join network".
                var checks = await db.RadCheck
                    .Where(rc => rc.Username == profile.Username)
                    .ToListAsync(ct);
                db.RadCheck.RemoveRange(checks);

-                // Insert Auth-Type := Reject to explicitly deny
                db.RadCheck.Add(new RadCheck
                {
                    Username = profile.Username,
-                    Attribute = "Auth-Type",
+                    Attribute = "NT-Password",
                    Op = ":=",
-                    Value = "Reject"
+                    Value = "0x00000000000000000000000000000000"
                });

                _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);