/usr/local/etc/raddb/sites-enabled/default
server default {
listen {
	type = auth
	ipaddr = *
	port = 1812
}
listen {
	type = acct
	ipaddr = *
	port = 1813
}

authorize {
#	filter_username
#	filter_password
	preprocess
#	operator-name
#	cui
##### AUTHORIZE FOR PLAIN MAC-AUTH IS DISABLED #####
#	auth_log
	chap
	mschap
	digest
#	wimax
#	IPASS
	suffix
	ntdomain
	eap {
		ok = return
#		updated = return
	}
#	unix
	files
	if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
			### sql DISABLED ###
	if (true) {

			
redundant {
	ldap
	# this line adds ldap2 when activated
	### ldap2 disabled ###
}

			if (notfound || noop) {
				reject
			}
		}
	}
	
	-daily
	-weekly
	-monthly
	-forever
	# Formerly checkval
	if (&request:Calling-Station-Id == &control:Calling-Station-Id) {
		ok
	}
	expiration
	logintime
	pap
	Autz-Type Status-Server {

	}
}

authenticate {
	Auth-Type PAP {
		pap
	}
	Auth-Type CHAP {
		chap
	}
	Auth-Type MS-CHAP {
		mschap
	}
	mschap
	Auth-Type MOTP {
		motp
	}
	Auth-Type GOOGLEAUTH {
		googleauth
	}
	digest
#	pam
#	unix

	Auth-Type LDAP {
		ldap
		### ldap2 disabled ###
	}

	eap
#	Auth-Type eap {
#		eap {
#			handled = 1
#		}
#		if (handled && (Response-Packet-Type == Access-Challenge)) {
#			attr_filter.access_challenge.post-auth
#			handled  # override the "updated" code from attr_filter
#		}
#	}
}

preacct {
	preprocess
##### ACCOUNTING FOR PLAIN MAC-AUTH DISABLED #####
#	acct_counters64
	update request {
		&FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
	}
acct_unique
#	IPASS
	suffix
	ntdomain
	files
}

accounting {
#	cui
	detail
	### This makes it possible to run the datacounter_acct module only on accounting-stop and interim-updates
	if ((request:Acct-Status-Type == Stop) || (request:Acct-Status-Type == Interim-Update)) {
		datacounterdaily
		datacounterweekly
		datacountermonthly
		datacounterforever
	}
#	unix
	radutmp
#	sradutmp
#	main_pool
	### sql DISABLED ###
	daily
	weekly
	monthly
	forever
#	if (noop) {
#		ok
#	}
#	pgsql-voip
	exec
	attr_filter.accounting_response
	Acct-Type Status-Server {

	}
}

session {
#	radutmp
	radutmp
}

post-auth {
#	if (!&reply:State) {
#		update reply {
#			State := "0x%{randstr:16h}"
#		}
#	}
	update {
		&reply: += &session-state:
	}
#	main_pool
#	cui
#	reply_log
### sql DISABLED ###
#	ldap
	exec
#	wimax
#	update reply {
#		Reply-Message += "%{TLS-Cert-Serial}"
#		Reply-Message += "%{TLS-Cert-Expiration}"
#		Reply-Message += "%{TLS-Cert-Subject}"
#		Reply-Message += "%{TLS-Cert-Issuer}"
#		Reply-Message += "%{TLS-Cert-Common-Name}"
#		Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
#
#		Reply-Message += "%{TLS-Client-Cert-Serial}"
#		Reply-Message += "%{TLS-Client-Cert-Expiration}"
#		Reply-Message += "%{TLS-Client-Cert-Subject}"
#		Reply-Message += "%{TLS-Client-Cert-Issuer}"
#		Reply-Message += "%{TLS-Client-Cert-Common-Name}"
#		Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
#	}
#	insert_acct_class
#	if (&reply:EAP-Session-Id) {
#		update reply {
#			EAP-Key-Name := &reply:EAP-Session-Id
#		}
#	}
	remove_reply_message_if_eap
	Post-Auth-Type REJECT {
		# log failed authentications in SQL, too.
		# sql
		attr_filter.access_reject
		eap
		remove_reply_message_if_eap
	}
	Post-Auth-Type Challenge {

	}
}

pre-proxy {
#	operator-name
#	cui
#	files
	attr_filter.pre-proxy
#	pre_proxy_log
}

post-proxy {

#	post_proxy_log
	attr_filter.post-proxy
	eap
#	Post-Proxy-Type Fail-Accounting {
#			detail
#	}
}
}