diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-09-26 08:29:22 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-09-26 08:29:22 +0200 |
| commit | 6a7558e586cfa91823512681e12944b065754774 (patch) | |
| tree | d32d0a05ee82d1751e3e03efbf98efc758850238 /python | |
| parent | 430dda1e170576239d3580c1b7a6381525a05cbc (diff) | |
| download | vyos-1x-6a7558e586cfa91823512681e12944b065754774.tar.gz vyos-1x-6a7558e586cfa91823512681e12944b065754774.zip | |
accel-ppp: T9357: do not require local users when any-login is configured
Committing "service pppoe-server authentication any-login" failed with
"Authentication mode local requires local users to be configured!" even
though any-login accepts any username/password combination, making local
user accounts pointless.
verify_accel_ppp_authentication() raised unconditionally whenever
authentication mode was "local" - the default - without ever consulting
the any-login option. Skip that requirement when any-login is set, while
keeping the password and rate-limit validation for users that are
configured.
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/accel_ppp_util.py | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/python/vyos/accel_ppp_util.py b/python/vyos/accel_ppp_util.py index 844bc56e5..c70f3b017 100644 --- a/python/vyos/accel_ppp_util.py +++ b/python/vyos/accel_ppp_util.py @@ -130,19 +130,23 @@ def verify_accel_ppp_authentication(config, local_users=True): Common helper function which must be used by all Accel-PPP services based on get_config_dict() """ + # "any-login" accepts every username/password combination, thus there is + # no need to have any local user account configured at all + any_login = False + if 'authentication' in config and 'any_login' in config['authentication']: + any_login = True + # verify auth settings if local_users and dict_search("authentication.mode", config) == "local": - if ( - dict_search("authentication.local_users", config) is None - or dict_search("authentication.local_users", config) == {} - ): + local_users_config = dict_search('authentication.local_users.username', + config, default={}) + + if not local_users_config and not any_login: raise ConfigError( "Authentication mode local requires local users to be configured!" ) - for user in dict_search("authentication.local_users.username", config): - user_config = config["authentication"]["local_users"]["username"][user] - + for user, user_config in local_users_config.items(): if "password" not in user_config: raise ConfigError(f'Password required for local user "{user}"') |