using AD.py to set autologin flag - only works on 2nd login!

luckman212

Hi,
I've followed the guide to setting up RADIUS post-auth at:
https://docs.openvpn.net/how-to-tutorialsguides/administration/integrating-active-directory-with-access-server-using-radius-and-post_auth/

I've done this so we can have the 'autologin' flag set on the users accounts when logging in via RADIUS (using Callback-Number attribute F1FFF). The RADIUS login itself works fine, but the problem is the autologin profile does not become available for them until they log off and then log back on a 2nd time.

I've followed everything to the tee I believe, so I'm stumped. Is this just "the way it is" or is there a fix?
Running OpenVPN AS v2.0.12 (deployed using the VMware OVF)

Thanks guys

luckman212

I think I may have figured it out. Only done very limited testing but it does seem to do the trick.

I basically added 2 lines to set the autologin session variable in addition to saving it to the database. Not sure why this wasn't put in by the original script's author, and I am by no means a python guru or expert on the inner workings of the OVPN auth process so use this with caution but - here it is:

Original script (start at line 33)

# Is the autologin bit set?
if ''.join(info['radius_reply'].get('Callback-Number'))[1] == '0':
  print "*** RADIUS-Reply: Overrride found for prop_autologin, setting to false..."
  proplist_save['prop_autologin'] = 'false'
elif ''.join(info['radius_reply'].get('Callback-Number'))[1] == '1':
  print "*** RADIUS-Reply: Overrride found for prop_autologin, setting to true..."
  proplist_save['prop_autologin'] = 'true'

Modified:

# Is the autologin bit set?
if ''.join(info['radius_reply'].get('Callback-Number'))[1] == '0':
  print "*** RADIUS-Reply: Overrride found for prop_autologin, setting to false..."
  authret['proplist']['prop_autologin'] = 'false'
  proplist_save['prop_autologin'] = 'false'
elif ''.join(info['radius_reply'].get('Callback-Number'))[1] == '1':
  print "*** RADIUS-Reply: Overrride found for prop_autologin, setting to true..."
  authret['proplist']['prop_autologin'] = 'true'
  proplist_save['prop_autologin'] = 'true'

Modified AD.py script attached.