<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Courier New">Dustin,</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Thanks for the response. I was kind of wondering if the location of the group in Active Directory was an issue. But that brings up another question. Doesn't a ldapsearch use the basedn as a starting point? If instance, I have the basedn set as follows in radiusd.conf:</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">basedn = "ou=mem users,dc=mem-ins,dc=com"</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">And the structure of our AD is:</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">MEM-INS.COM</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |_MEM Users</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> |</FONT>
</P>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<P><FONT SIZE=2 FACE="Courier New">And why is it that it can find the user "rgraham" but not the group. </FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2 FACE="Courier New">> I'm trying to get Freeradius configured to authenicate our vpn users</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> from a Cisco 3005 concentrator against Active Directory using the ldap</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> module. When I authenicated a vpn user on a per user basis - it works</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> fine. However, I want authenicate not only the user, but also verify</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> that the user is a member of a "group" in active directory. I was</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> following Dustin Doris's suggestion on Per-Client "group" matching and</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> configured the huntgroups, users, and radiusd.conf accordingly.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> However, it seems to fail doing a group lookup. I don't know if it</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> matters, but the user object and group object in Active Directory are in</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> different containers (OU's). Any help would be appreciated.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">You need to specify where the groups are located in AD.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">> rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> users,dc=mem-ins,dc=com' radius_xlat:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> users,dc=mem-ins,dc=com, with filter</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> search result rlm_ldap: ldap_release_conn: Release Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> member.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> users: Matched DEFAULT at 166</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">The user was not found in that group, based on the lookup above.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">> groupname_attribute = cn</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> groupmembership_filter =</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> (&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> groupmembership_attribute = radiusGroupName</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">You have to modify these so you can find the group memberships. For</FONT>
<BR><FONT SIZE=2 FACE="Courier New">example, how would you perform an ldapsearch from the command line to</FONT>
<BR><FONT SIZE=2 FACE="Courier New">find group memberships? Take that info and put it there. Make sure the</FONT>
<BR><FONT SIZE=2 FACE="Courier New">user you are binding with has access to read those groups.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Hope that is a little helpful.</FONT>
</P>
<BR>
<BR>
</BODY>
</HTML>