<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>Re: Problem with LDAP group searches</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Courier New">>> I'm trying to get Freeradius configured to authenicate our vpn users</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> from a Cisco 3005 concentrator against Active Directory using the ldap</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> module. When I authenicated a vpn user on a per user basis - it works</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> fine. However, I want authenicate not only the user, but also verify</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> that the user is a member of a "group" in active directory. I was</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> following Dustin Doris's suggestion on Per-Client "group" matching and</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> configured the huntgroups, users, and radiusd.conf accordingly.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> However, it seems to fail doing a group lookup. I don't know if it</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> matters, but the user object and group object in Active Directory are in</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> different containers (OU's). Any help would be appreciated.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>></FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">>You need to specify where the groups are located in AD.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">But isn't this the purpose of setting the basedn in radiusd.conf? Or is there another seeting that I need to configure for ldap group searches?</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> users,dc=mem-ins,dc=com' radius_xlat:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> users,dc=mem-ins,dc=com, with filter</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> search result rlm_ldap: ldap_release_conn: Release Id: 0</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> member.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> users: Matched DEFAULT at 166</FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">>The user was not found in that group, based on the lookup above.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">The user is a member of the MEMVPNFlex group in AD</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> groupname_attribute = cn</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> groupmembership_filter =</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> (&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>> groupmembership_attribute = radiusGroupName</FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">>You have to modify these so you can find the group memberships. For</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>example, how would you perform an ldapsearch from the command line to</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>find group memberships? Take that info and put it there. Make sure the</FONT>
<BR><FONT SIZE=2 FACE="Courier New">>user you are binding with has access to read those groups.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">>Hope that is a little helpful.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
<BR><FONT SIZE=2 FACE="Courier New">></FONT>
</P>
</BODY>
</HTML>