radiuscontroller/Services/AccountEnforcementService.cs

@@ -87,19 +87,20 @@ public class AccountEnforcementService : BackgroundService
                 // Disable the account
                 profile.Status = "Expired";
 
-                // Scramble the password so the device prompts for new credentials
+                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
-                var check = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password", ct);
+                var checks = await db.RadCheck
-                if (check != null)
+                    .Where(rc => rc.Username == profile.Username)
-                {
+                    .ToListAsync(ct);
-                    check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
+                db.RadCheck.RemoveRange(checks);
-                }
 
-                // Cleanup any old Auth-Type Reject entries
+                // Insert Auth-Type := Reject to explicitly deny
-                var rejectCheck = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type", ct);
+                db.RadCheck.Add(new RadCheck
-                if (rejectCheck != null)
                 {
-                    db.RadCheck.Remove(rejectCheck);
+                    Username = profile.Username,
-                }
+                    Attribute = "Auth-Type",
+                    Op = ":=",
+                    Value = "Reject"
+                });
 
                 _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);
 

radiuscontroller/Services/RadiusService.cs

@@ -272,18 +272,17 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Scramble the password instead of Auth-Type := Reject so devices prompt for new credentials
+        // Remove Cleartext-Password and insert Auth-Type := Reject
-        var check = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password");
+        var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
-        if (check != null)
+        _db.RadCheck.RemoveRange(checks);
-        {
-            check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
-        }
 
-        var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");
+        _db.RadCheck.Add(new RadCheck
-        if (rejectCheck != null)
         {
-            _db.RadCheck.Remove(rejectCheck);
+            Username = profile.Username,
-        }
+            Attribute = "Auth-Type",
+            Op = ":=",
+            Value = "Reject"
+        });
 
         await _db.SaveChangesAsync();
 
@@ -332,7 +331,7 @@ public class RadiusService : IRadiusService
             });
         }
 
-        if (profile.Status == "Revoked" || profile.Status == "Expired")
+        if (profile.Status == "Revoked")
         {
             profile.Status = "Active";
             var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");