don't allow: Foo = &Client-Shortname

it won't work, because the attribut doesn't exist, it's virtual.
It has to be "%{Client-Shortname}"

diff --git a/src/main/map.c b/src/main/map.c
index 97a68da5fc5c15bee31fecdbcfeee428fd354239..17988d27f9d8208dc224d6fd3f413725c21a8998 100644 (file)
--- a/src/main/map.c
+++ b/src/main/map.c
@@ -297,14 +297,20 @@ int map_afrom_cp(TALLOC_CTX *ctx, vp_map_t **out, CONF_PAIR *cp,
                goto error;
        }
 
-       /*
-        *      We cannot assign a count to an attribute.  That must
-        *      be done in an xlat.
-        */
-       if ((map->rhs->type == TMPL_TYPE_ATTR) &&
-           (map->rhs->tmpl_num == NUM_COUNT)) {
-               cf_log_err_cp(cp, "Cannot assign from a count");
-               goto error;
+       if (map->rhs->type == TMPL_TYPE_ATTR) {
+               /*
+                *      We cannot assign a count to an attribute.  That must
+                *      be done in an xlat.
+                */
+               if (map->rhs->tmpl_num == NUM_COUNT) {
+                       cf_log_err_cp(cp, "Cannot assign from a count");
+                       goto error;
+               }
+
+               if (map->rhs->tmpl_da->flags.virtual) {
+                       cf_log_err_cp(cp, "Virtual attributes must be in an expansion such as \"%%{%s}\".", map->rhs->tmpl_da->name);
+                       goto error;
+               }
        }
 
        VERIFY_MAP(map);