<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>Problem with LDAP group searches</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I'm trying to get Freeradius configured to authenicate our vpn users from a Cisco 3005 concentrator against Active Directory using the ldap module. When I authenicated a vpn user on a per user basis - it works fine. However, I want authenicate not only the user, but also verify that the user is a member of a "group" in active directory. I was following Dustin Doris's suggestion on Per-Client "group" matching and configured the huntgroups, users, and radiusd.conf accordingly. However, it seems to fail doing a group lookup. I don't know if it matters, but the user object and group object in Active Directory are in different containers (OU's). Any help would be appreciated. </FONT></P>
<P><FONT SIZE=2 FACE="Arial">Thanks</FONT>
<BR><FONT SIZE=2 FACE="Arial">Robert Graham</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">##########</FONT>
<BR><FONT SIZE=2 FACE="Arial">Debug out:</FONT>
<BR><FONT SIZE=2 FACE="Arial">##########</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">rad_recv: Access-Request packet from host 172.16.1.91:1054, id=40, length=119</FONT>
<BR><FONT SIZE=2 FACE="Arial"> User-Name = "rgraham"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> User-Password = "XXXXXXXXXX"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> NAS-Port = 1036</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Service-Type = Framed-User</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Framed-Protocol = PPP</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Called-Station-Id = "192.168.15.1"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Calling-Station-Id = "192.168.15.2"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Tunnel-Client-Endpoint:0 = "192.168.15.2"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> NAS-IP-Address = 172.16.1.91</FONT>
<BR><FONT SIZE=2 FACE="Arial"> NAS-Port-Type = Virtual</FONT>
<BR><FONT SIZE=2 FACE="Arial">rad_lowerpair: User-Name now 'rgraham'</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Processing the authorize section of radiusd.conf</FONT>
<BR><FONT SIZE=2 FACE="Arial">modcall: entering group authorize for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "preprocess" returns ok for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: - authorize</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: performing user authorization for rgraham</FONT>
<BR><FONT SIZE=2 FACE="Arial">radius_xlat: '(sAMAccountName=rgraham)'</FONT>
<BR><FONT SIZE=2 FACE="Arial">radius_xlat: 'ou=mem users,dc=mem-ins,dc=com'</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: ldap_get_conn: Checking Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: ldap_get_conn: Got Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: attempting LDAP reconnection</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: (re)connect to mem_co_dept1.mem-ins.com:389, authentication 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: bind as cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com/XXXXXXXXXX to mem_co_dept1.mem-ins.com:389</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: waiting for bind result ...</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: Bind was successful</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham)</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: looking for check items in directory...</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: looking for reply items in directory...</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: user rgraham authorized to use remote access</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: ldap_release_conn: Release Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "ldap" returns ok for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "chap" returns noop for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "mschap" returns noop for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rlm_realm: No such realm "NULL"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "suffix" returns noop for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rlm_eap: No EAP-Message, not doing EAP</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "eap" returns noop for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: Entering ldap_groupcmp()</FONT>
<BR><FONT SIZE=2 FACE="Arial">radius_xlat: 'ou=mem users,dc=mem-ins,dc=com'</FONT>
<BR><FONT SIZE=2 FACE="Arial">radius_xlat: '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))'</FONT></P>
<P><FONT SIZE=2 FACE="Arial">rlm_ldap: ldap_get_conn: Checking Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: ldap_get_conn: Got Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))))</FONT></P>
<P><FONT SIZE=2 FACE="Arial">rlm_ldap: object not found or got ambiguous search result</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap: ldap_release_conn: Release Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a member.</FONT>
<BR><FONT SIZE=2 FACE="Arial"> users: Matched DEFAULT at 166</FONT>
<BR><FONT SIZE=2 FACE="Arial"> modcall[authorize]: module "files" returns ok for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">modcall: group authorize returns ok for request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rad_check_password: Found Auth-Type Reject</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rad_check_password: Auth-Type = Reject, rejecting user</FONT>
<BR><FONT SIZE=2 FACE="Arial">auth: Failed to validate the user.</FONT>
<BR><FONT SIZE=2 FACE="Arial">Delaying request 0 for 1 seconds</FONT>
<BR><FONT SIZE=2 FACE="Arial">Finished request 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Going to the next request</FONT>
<BR><FONT SIZE=2 FACE="Arial">--- Walking the entire request list ---</FONT>
<BR><FONT SIZE=2 FACE="Arial">Waking up in 1 seconds...</FONT>
<BR><FONT SIZE=2 FACE="Arial">--- Walking the entire request list ---</FONT>
<BR><FONT SIZE=2 FACE="Arial">Waking up in 1 seconds...</FONT>
<BR><FONT SIZE=2 FACE="Arial">--- Walking the entire request list ---</FONT>
<BR><FONT SIZE=2 FACE="Arial">Sending Access-Reject of id 40 to 172.16.1.91:1054</FONT>
<BR><FONT SIZE=2 FACE="Arial">Waking up in 4 seconds...</FONT>
<BR><FONT SIZE=2 FACE="Arial">--- Walking the entire request list ---</FONT>
<BR><FONT SIZE=2 FACE="Arial">Cleaning up request 0 ID 40 with timestamp 42b1c93a</FONT>
<BR><FONT SIZE=2 FACE="Arial">Nothing to do. Sleeping until we see a request.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">############</FONT>
<BR><FONT SIZE=2 FACE="Arial">Users file:</FONT>
<BR><FONT SIZE=2 FACE="Arial">############</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">DEFAULT Huntgroup-Name == vpnusers, LDAP-Group == MEMVPNFlex, Auth-Type := LDAP</FONT>
<BR><FONT SIZE=2 FACE="Arial"> OU = TestGroup</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Fall-Through = 1</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">############</FONT>
<BR><FONT SIZE=2 FACE="Arial">huntgroup</FONT>
<BR><FONT SIZE=2 FACE="Arial">############</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">vpnusers NAS-IP-Address == 172.16.1.91</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">#######################</FONT>
<BR><FONT SIZE=2 FACE="Arial">ldap section of radiusd.conf</FONT>
<BR><FONT SIZE=2 FACE="Arial">#######################</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> ldap {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> server = "mem_co_dept1.mem-ins.com"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> basedn = "ou=mem users,dc=mem-ins,dc=com"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> identity = "cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> password = XXXXXXXXXX</FONT>
<BR><FONT SIZE=2 FACE="Arial"> start_tls = no</FONT>
<BR><FONT SIZE=2 FACE="Arial"> dictionary_mapping = ${raddbdir}/ldap.attrmap</FONT>
<BR><FONT SIZE=2 FACE="Arial"> ldap_connections_number = 5</FONT>
<BR> <FONT SIZE=2 FACE="Arial"> password_attribute = userPassword</FONT>
<BR><FONT SIZE=2 FACE="Arial"> groupname_attribute = cn</FONT>
<BR><FONT SIZE=2 FACE="Arial"> groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> groupmembership_attribute = radiusGroupName</FONT>
<BR><FONT SIZE=2 FACE="Arial"> timeout = 4</FONT>
<BR><FONT SIZE=2 FACE="Arial"> timelimit = 3</FONT>
<BR><FONT SIZE=2 FACE="Arial"> net_timeout = 1</FONT>
<BR><FONT SIZE=2 FACE="Arial"> }</FONT>
</P>
</BODY>
</HTML>