server default {

listen {
	type = auth
	ipaddr = *
	port = 0

	limit {
	      max_connections = 16
	      lifetime = 0
	      idle_timeout = 30
	}
}

listen {
	ipaddr = *
	port = 0
	type = acct

	limit {
	}
}

listen {
	type = auth
	ipv6addr = ::
	port = 0
	limit {
	      max_connections = 16
	      lifetime = 0
	      idle_timeout = 30
	}
}

listen {
	ipv6addr = ::
	port = 0
	type = acct

	limit {
	}
}

authorize {
	rest
	if (ok) {
		update control {
			Auth-Type := rest
		}
	}

	filter_username
	preprocess
	chap
	mschap
	digest
	suffix

	eap {
		ok = return
	}

	files
	-sql
	-ldap

	expiration
	logintime

	pap

	Autz-Type New-TLS-Connection {
		  ok
	}
}

authenticate {
	Auth-Type rest {
		rest {
			updated = 1
		}
		if (updated) {
			ok
		}
	}
	Auth-Type rest {
		rest
	}

	Auth-Type PAP {
		pap
	}

	Auth-Type CHAP {
		chap
	}

	Auth-Type MS-CHAP {
		mschap
	}

	mschap
	digest
	eap
}

preacct {
	preprocess
	acct_unique
	suffix
	files
}

accounting {
	detail
	rest
	unix
	-sql
	exec
	attr_filter.accounting_response
}

session {
}

post-auth {
	if (reply:Group-Name) {
		update control {
			&Group := "%{reply:Group-Name}"
		}
	}
	if (reply:Mikrotik-Rate-Limit) {
		update reply {
			Mikrotik-Rate-Limit := "%{reply:Mikrotik-Rate-Limit}"
		}
	}
	if (reply:Expiration) {
		update reply {
			Expiration := "%{reply:Expiration}"
		}
	}

	if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
		update reply {
			&User-Name !* ANY
		}
	}
	update {
		&reply: += &session-state:
	}

	-sql
	exec
	remove_reply_message_if_eap

	Post-Auth-Type REJECT {
		-sql
		attr_filter.access_reject
		eap
		remove_reply_message_if_eap
	}

	Post-Auth-Type Challenge {
	}

	Post-Auth-Type Client-Lost {
	}

	if (EAP-Key-Name && &reply:EAP-Session-Id) {
		update reply {
			&EAP-Key-Name := &reply:EAP-Session-Id
		}
	}
}

pre-proxy {
}

post-proxy {
	eap
}
}
