radiuscontroller/Services/AccountEnforcementService.cs

@@ -87,20 +87,19 @@ public class AccountEnforcementService : BackgroundService
                 // Disable the account
                 profile.Status = "Expired";
 
-                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
+                // Scramble the password so the device prompts for new credentials
-                var checks = await db.RadCheck
+                var check = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password", ct);
-                    .Where(rc => rc.Username == profile.Username)
+                if (check != null)
-                    .ToListAsync(ct);
-                db.RadCheck.RemoveRange(checks);
-
-                // Insert Auth-Type := Reject to explicitly deny
-                db.RadCheck.Add(new RadCheck
                 {
-                    Username = profile.Username,
+                    check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
-                    Attribute = "Auth-Type",
+                }
-                    Op = ":=",
+
-                    Value = "Reject"
+                // Cleanup any old Auth-Type Reject entries
-                });
+                var rejectCheck = await db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type", ct);
+                if (rejectCheck != null)
+                {
+                    db.RadCheck.Remove(rejectCheck);
+                }
 
                 _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);
 

radiuscontroller/Services/RadiusService.cs

@@ -272,17 +272,18 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Remove Cleartext-Password and insert Auth-Type := Reject
+        // Scramble the password instead of Auth-Type := Reject so devices prompt for new credentials
-        var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
+        var check = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password");
-        _db.RadCheck.RemoveRange(checks);
+        if (check != null)
-
-        _db.RadCheck.Add(new RadCheck
         {
-            Username = profile.Username,
+            check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
-            Attribute = "Auth-Type",
+        }
-            Op = ":=",
+
-            Value = "Reject"
+        var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");
-        });
+        if (rejectCheck != null)
+        {
+            _db.RadCheck.Remove(rejectCheck);
+        }
 
         await _db.SaveChangesAsync();
 
@@ -331,7 +332,7 @@ public class RadiusService : IRadiusService
             });
         }
 
-        if (profile.Status == "Revoked")
+        if (profile.Status == "Revoked" || profile.Status == "Expired")
         {
             profile.Status = "Active";
             var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");