Free radius authentication with AD using ldap

Vikash Gounder Vikash.Gounder at acu.edu.au
Mon Nov 28 22:03:21 CET 2011


Hi Fajar,

Thanks so much for replying.

The debug log for local test against AD is attached:

Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on proxy address * port 1814
Ready to process requests.

rad_recv: Access-Request packet from host 127.0.0.1 port 35067, id=16, length=61
        User-Name = "uldaptest"
        User-Password = "usk.173n!"
        NAS-IP-Address = 192.148.223.54
        NAS-Port = 0
+- entering group authorize {...}
++[preprocess] returns ok
[auth_log]      expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20111129
[auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20111129
[auth_log]      expand: %t -> Tue Nov 29 07:54:47 2011
++[auth_log] returns ok
[suffix] No '@' in User-Name = "uldaptest", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[ldap] performing user authorization for uldaptest
[ldap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details
[ldap]  expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=uldaptest))
[ldap]  expand: dc=acu,dc=edu,dc=au -> dc=acu,dc=edu,dc=au
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to acustaff.acu.edu.au:3268, authentication 0
rlm_ldap: bind as cn=Radauth,cn=Users,dc=acustaff,dc=acu,dc=edu,dc=au/9yRD1133 to acustaff.acu.edu.au:3268
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in dc=acu,dc=edu,dc=au, with filter (&(sAMAccountName=uldaptest))
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
[ldap] Setting Auth-Type = LDAP
[ldap] user uldaptest authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = LDAP
+- entering group LDAP {...}
[ldap] login attempt by "uldaptest" with password "usk.173n!"
[ldap] user DN: CN=Unilinc ldaptest,OU=System Accounts,OU=Generic Accounts,DC=acustaff,DC=acu,DC=edu,DC=au
rlm_ldap: (re)connect to acustaff.acu.edu.au:3268, authentication 1
rlm_ldap: bind as CN=Unilinc ldaptest,OU=System Accounts,OU=Generic Accounts,DC=acustaff,DC=acu,DC=edu,DC=au/usk.173n! to acustaff.acu.edu.au:3268
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
[ldap] user uldaptest authenticated succesfully
++[ldap] returns ok
        expand: Host %n -> Host 192.148.223.54
Login OK: [uldaptest] (from client localhost port 0) Host 192.148.223.54
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 16 to 127.0.0.1 port 35067
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 16 with timestamp +4
Ready to process requests.

And the reply:

[root at panvpufreeradi1 ~]# radtest uldaptest usk.173n! localhost 0 testing123
Sending Access-Request of id 16 to 127.0.0.1 port 1812
        User-Name = "uldaptest"
        User-Password = "usk.173n!"
        NAS-IP-Address = 192.148.223.54
        NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=16, length=20

On the AD, the user is configured, any extra setting that I need to do on AD which Iam not aware about??

I got a question for you?? If only using for WPA, do I also need to configure samba and use nltm_auth, since this radius device will be used by ipad, netbooks etc etc etc....

Here is the configure for default and inner-tunnel without the comments, I may have done something wrong here:

default
----------------------
authorize {
	preprocess
	auth_log
	suffix
	eap {
		ok = return
	}
	ldap
	expiration
	logintime
	pap
}

authenticate {
	Auth-Type PAP {
		pap
	}

	Auth-Type LDAP {
		ldap
	}
	eap
}


preacct {
	preprocess
	acct_unique
	suffix
	files
}

accounting {
	detail
	unix
	radutmp
	attr_filter.accounting_response
}

session {
	radutmp
}


post-auth {
	exec
	Post-Auth-Type REJECT {
		attr_filter.access_reject
	}
}

pre-proxy {
}

post-proxy {
	#eap
}


------------

Inner tunnel
---------------------

server inner-tunnel {
authorize {
	chap
	mschap
	unix
	suffix
	update control {
	       Proxy-To-Realm := LOCAL
	}
	eap {
		ok = return
	}
	files
	ldap
	expiration
	logintime
	pap
}

authenticate {
	Auth-Type PAP {
		pap
	}

	Auth-Type LDAP {
		ldap
	}
	eap
}

session {
	radutmp
}


post-auth {
}

pre-proxy {
}

post-proxy {
	eap
}
} # inner-tunnel server block
---------------------

I greatly appreciate your feedback. Do advise if you need to view other config files.

Thanks
Vikash

-----Original Message-----
From: freeradius-users-bounces+vikash.gounder=acu.edu.au at lists.freeradius.org [mailto:freeradius-users-bounces+vikash.gounder=acu.edu.au at lists.freeradius.org] On Behalf Of Fajar A. Nugraha
Sent: Monday, 28 November 2011 4:44 PM
To: FreeRadius users mailing list
Subject: Re: Free radius authentication with AD using ldap

On Mon, Nov 28, 2011 at 12:29 PM, Vikashgounder <Vikash.gounder at acu.edu.au> wrote:
> From the local radtest I can see, it is authenticating fine but when 
> testing

... and where is the debug log for that?

> with a wpa device, this is the error m getting on the debug log:

It's quite informative, actually:

[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?

If you use AD as ldap, the user password is not accessible in any ldap attribute. Thus you normally have to use ntlm_auth. See
- http://deployingradius.com/documents/configuration/active_directory.html
- http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO
(old version, but some of it might be still relevant)

Some other thing to check:
- Are you setting Auth-Type manually? You shouldn't need to
- If you REALLY have radtest working, then it's usually a matter of making sure configuration in sites-available/default (the one used if you use PAP directly, e.g. with radtest) is also in sites-available/inner-tunnel (the one used to handle AAA inside EAP tunnel, like when you use EAP-PEAP-MSCHAPv2)

--
Fajar
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html




More information about the Freeradius-Users mailing list