[feature]: Allow updating attributes from rlm_rest when a 401 is encountered

[uedvt359]

What type of feature is needed?

Changed behavior to existing functionality

What is the feature?

We are using rlm_rest to authenticate users. our REST service is responding with a JSON structure, that - on accept (http/200) - automatically updates attributes (e.g. which VLAN to place the user into). When a client gets rejected (http/401), the attributes are not updated. we would like this to happen, so we can e.g. log the rejection reason.

Right now, the documentation states the following (emphasis mine):

If the body is processed and found to contain attribute updated will be returned, except in the case of a 401 code.

So this is expected behaviour right now. One can also see why this is the case in the source.

When the status code is 2xx, and rest_response_decode() is successful, RLM_MODULE_UPDATED is returned. As per this comment, that means that attributes will get updated.

freeradius-server/src/modules/rlm_rest/rlm_rest.c

Lines 668 to 671 in 086688f

	ret = rest_response_decode(inst, section, request, handle);
	if (ret < 0) rcode = RLM_MODULE_FAIL;
	else if (ret == 0) rcode = RLM_MODULE_OK;
	else rcode = RLM_MODULE_UPDATED;

When the status code is 401 though, RLM_MODULE_REJECT is always returned.

freeradius-server/src/modules/rlm_rest/rlm_rest.c

Lines 650 to 654 in 086688f

	ret = rest_response_decode(inst, section, request, handle);
	if (ret < 0) {
	rcode = RLM_MODULE_FAIL;
	break;
	}

There is no RLM_MODULE_REJECT_AND_UPDATE.

---

I see two ways this feature could be implemented. Both would first need a way to do a upddate-and-reject. radiusd could either start updating attributes on 401 (possibly requiring a module config flag to stay backwards-compatible), or a different 4xx error code could be used to achieve this.