Return codes

Many operations in the server produce a return code (rcode). The different rcodes give a course indication of whether a particular operation (a module call, string expansion, or keyword) was successful.

Unlike return values in other languages, FreeRADIUS' rcodes are are always taken from a fixed compiled-in set.

Return code Description

Return code	Description
`fail`	The operation failed. Usually as a result of an external dependency like a database being unavailable or an internal error.
`handled`	The request has been "handled", no further policies in the current section should be called, and the section should immediately exit.
`invalid`	The request, or operation, was invalid. In the case of requests this usually indicates absent or malformed attribute values.
`noop`	The operation did nothing.
`notfound`	A 'lookup' operation returned no results.
`ok`	Operation completed successfully but did not change any attributes in the request.
`reject`	The operation indicates the current request should be 'rejected'. What this actually means is different from protocol to protocol. It usually means that access to the requested resource should be denied, or that the current request should be NAKd. Usually returned when provided credentials were invalid.
`updated`	The operation completed successfully and updated one or more attributes in the request.
`disallow`	Access to a particular resource is denied. This is similar to `reject` but is the result of an authorizational check failing, as opposed to credentials being incorrect.
`yield`	Returned by an operation when execution of a request should be suspended.

fail

The operation failed. Usually as a result of an external dependency like a database being unavailable or an internal error.

handled

The request has been "handled", no further policies in the current section should be called, and the section should immediately exit.

invalid

The request, or operation, was invalid. In the case of requests this usually indicates absent or malformed attribute values.

noop

The operation did nothing.

notfound

A 'lookup' operation returned no results.

ok

Operation completed successfully but did not change any attributes in the request.

reject

The operation indicates the current request should be 'rejected'. What this actually means is different from protocol to protocol. It usually means that access to the requested resource should be denied, or that the current request should be NAKd. Usually returned when provided credentials were invalid.

updated

The operation completed successfully and updated one or more attributes in the request.

disallow

Access to a particular resource is denied. This is similar to reject but is the result of an authorizational check failing, as opposed to credentials being incorrect.

yield

Returned by an operation when execution of a request should be suspended.

In versions ≤ v3.2.x the disallow rcode was called userlock. disallow and userlock have an identical meaning. disallow will be returned in any instance where userlock was returned in v3.0.x or v3.2.x

Return codes propagate through nested unlang sections based on their priority. If a rcode returned by an operation has a higher priority than the current rcode associated with the request, then the request rcode is overwritten.

Return code priorities are assigned by the section the module call, expansion or keyword was used in.