Radius enforce roles (#15294)

Add new setting to specify if user roles will be set at login or not.
Without this setting enabled, roles are only set when the user is first created and never after that. If roles set via Filter-ID attribute or radius.default_roles change, they will never be reflected on existing users.
For that reason, the default is set to enabled.  Historically, radius did not enforce roles.
This commit is contained in:
Tony Murray
2023-09-07 11:28:35 -05:00
committed by GitHub
parent 2618a99be5
commit b51ae39e71
3 changed files with 16 additions and 2 deletions

View File

@@ -1265,6 +1265,10 @@ return [
'description' => 'Default user roles',
'help' => 'Sets the roles that will be assigned to the user unless Radius sends attributes that specify role(s)',
],
'enforce_roles' => [
'description' => 'Enforce roles at login',
'help' => 'If enabled, roles will be set to the ones specified by the Filter-ID attribute or radius.default_roles at login. Otherwise, they will be set when the user is created and never changed after that.',
],
],
'reporting' => [
'error' => [