must
must
Requires another action to return an accept or reject result. If the wrapped
action returns ignore, must converts the result to reject and sets
aaa.reason.
Use must when an action should be applicable to the current request. For
example, use it to reject a request that does not contain credentials for the
configured authentication method.
Syntax
must <action>;
must <action> { }
Example
@execute {
must pap;
}
If the request does not contain a PAP password, pap returns ignore. The
must action converts that ignore result to reject.
Select the authentication method first
For RADIUS, use radius.request.method in policy or handler conditions to select
the authentication method before actions execute. A PAP handler can then skip
CHAP and EAP requests instead of selecting them and later rejecting them with
must pap:
handler "PAP" {
conditions all {
radius.request.method == radius.METHOD_PAP;
}
@execute {
backend "USERS";
must pap;
}
}
Other methods can select their own matching handlers. Keep must pap to reject
an ignore result within the selected PAP handler, such as when the backend
supplies no stored password. Method selection does not verify credentials.
See the request method constants for the available method values.
Result Handling
must preserves accept and reject results from the wrapped action:
- Accept remains accept.
- Reject remains reject.
- Ignore becomes reject.
When ignore becomes reject, must sets aaa.reason to must: unexpected ignore from the wrapped '<action-name>' action