3.28.4. DynamicCheck Previous topic Parent topic Child topic Next topic

This optional parameter specifies a check item that will be eligible for run-time variable substitution prior to authentication. That means that you can use any of the % substitutions in table at Section 3.3. Special characters in that check item. You can specify any number of Dynamic- Check lines, one for each check item you want to do replacements on.
In the following example, substitution is enabled for the Group check item. When a user authenticates, the %{Shiva-VPN-Group} in the check item will be replaced with the value of the Shiva-VPN-Group attribute in the authentication request. You could use this mechanism to verify that the user is in the Unix group corresponding to their Shiva-VPN-Group.
<AuthBy whatever>
      DynamicCheck Group
In the users file:
DEFAULT Group=%{Shiva-VPN-Group}
      Framed-IP-Address =,
      Framed-Routing = None,
      Framed-IP-Netmask =,