commit 74f775dbe4e66a6f10548c389916a2d6f9eca665
Author: Gary Steers <gary@steersnet.org.uk>
Date:   Mon Mar 16 23:04:57 2020 +0000

    Check in of modified file, known to work
    with Access server 2.7.5

diff --git a/post_auth_radius_mapping.py b/post_auth_radius_mapping.py
new file mode 100644
index 0000000..5aac43d
--- /dev/null
+++ b/post_auth_radius_mapping.py
@@ -0,0 +1,82 @@
+from pyovpn.plugin import *
+
+#
+# Following has been updated as tempoary workaround to issues with OpenVPN Radius Responses...
+#
+
+def post_auth(authcred, attributes, authret, info):
+
+    # Create user prop list, if one does not already exist
+    proplist = authret.setdefault('proplist', {})
+
+    # user properties to save
+    proplist_save = {}
+
+    # Proceed with post_auth script if the server is using RADIUS, otherwise skip this script
+    if info.get('auth_method') == 'radius':
+
+        # Every valid user should be able to connect to the VPN
+        authret['proplist']['prop_autogenerate'] = 'true'
+
+        # Evaluating RADIUS server reply for user access flags, 19 is the new code for Callback-Number
+        if 19 in info['radius_reply']:
+
+            print("***** RADIUS-Reply: Callback-Number received, evaluating reply for OpenVPN Access Server access flags...")
+
+            # Does it look like we are dealing with some access flags?
+            if ''.join(info['radius_reply'].get(19)).__len__() == 5:
+
+                # Is the superuser bit set?
+                if ''.join(info['radius_reply'].get(19))[0] == '0':
+                    print("*** RADIUS-Reply: Overrride found for prop_superuser, setting to false...")
+                    authret['proplist']['prop_superuser'] = 'false'
+                elif ''.join(info['radius_reply'].get(19))[0] == '1':
+                    print("*** RADIUS-Reply: Overrride found for prop_superuser, setting to true...")
+                    authret['proplist']['prop_superuser'] = 'true'
+
+                # Is the autologin bit set?
+                if ''.join(info['radius_reply'].get(19))[1] == '0':
+                    print("*** RADIUS-Reply: Overrride found for prop_autologin, setting to false...")
+                    proplist_save['prop_autologin'] = 'false'
+                elif ''.join(info['radius_reply'].get(19))[1] == '1':
+                    print("*** RADIUS-Reply: Overrride found for prop_autologin, setting to true...")
+                    proplist_save['prop_autologin'] = 'true'
+
+                # Is the lzo bit set?
+                if ''.join(info['radius_reply'].get(19))[2] == '0':
+                    print("*** RADIUS-Reply: Overrride found for prop_lzo, setting to false...")
+                    authret['proplist']['prop_lzo'] = 'false'
+                elif ''.join(info['radius_reply'].get(19))[2] == '1':
+                    print("*** RADIUS-Reply: Overrride found for prop_lzo, setting to true...")
+                    authret['proplist']['prop_lzo'] = 'true'
+
+                # Is the reroute_gw bit set?
+                if ''.join(info['radius_reply'].get(19))[3] == '0':
+                    print("*** RADIUS-Reply: Overrride found for prop_reroute_gw_override, setting to 'disable'...")
+                    authret['proplist']['prop_reroute_gw_override'] = 'disable'
+                elif ''.join(info['radius_reply'].get(19))[3] == '1':
+                    print("*** RADIUS-Reply: Overrride found for prop_reroute_gw_override, setting to 'dns_only'...")
+                    authret['proplist']['prop_reroute_gw_override'] = 'dns_only'
+
+                # Is the deny_web bit set?
+                if ''.join(info['radius_reply'].get(19))[4] == '0':
+                    print("*** RADIUS-Reply: Overrride found for prop_deny_web, setting to false...")
+                    authret['proplist']['prop_deny_web'] = 'false'
+                elif ''.join(info['radius_reply'].get(19))[4] == '1':
+                    print("*** RADIUS-Reply: Overrride found for prop_deny_web, setting to true...")
+                    authret['proplist']['prop_deny_web'] = 'true'
+
+        # If Framed-Pool is set, set that as the group for the AS server, 88 is the Framed-Pool response
+        if 88 in info['radius_reply']:
+            print("***** RADIUS-Reply: Framed-Pool received, setting OpenVPN Access Server group to:", ''.join(info['radius_reply'].get(88)))
+            authret['proplist']['conn_group'] = ''.join(info['radius_reply'].get(88))
+
+        # If a static IP address is defined, use it, unless the group is not explicitly defined, 8 is the Framed-IP-Address respone
+        if 8 in info['radius_reply']:
+            if authret['proplist'].get('conn_group') is not None:
+                print("***** RADIUS-Reply: Framed-IP-Address received, trying to set client IP address to: %s with group name: %s" % (''.join(info['radius_reply'].get(8)), authret['proplist'].get('conn_group')))
+                authret['proplist']['conn_ip'] = ''.join(info['radius_reply'].get(8))
+            else:
+                print("*** RADIUS-Reply: Framed-IP-Address received, but no group name is specified. Ignoring reply attribute...")
+
+    return authret, proplist_save