<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>I have tried and
nearly completely succeeded in authentication and authorization. The user is
identified in LDAP just not provided access (rad_recv: Access-Reject packet from
host 10.1.1.27:1812, id=121, length=20).</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>Another issue I have
is with the user login. In Windowz, a new user is created by providing the
First name, middle initial and last name which is not their "User logon name".
These credentials are distributed within AD-LDAP in the "CN=" fields
using spaces to break the name. If this is not exactly how the "User
logon name" is installed then radius request rejects authentication.
An example would be:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>User Tom
Thumb</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>Logon
tthumb</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>CN=Tom
Thumb</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006>sAMAccountName=radtest</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>So when a request of
the database occurrs using ldap lookup with "cn=tthumb" it fails and I
do not know if there is another way around this but using sAMAccountName doesn't
work either.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>I am hopeful that I
am missing something.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>My question is, how
do I get an "Accept" from the request and is there a way around the
basedn naming conventions that will alllow FreeRadius to work with
Windowz?</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>Below is user
"testing" with a logon of "testing".</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=297411820-09012006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=297411820-09012006>rlm_ldap: -
authorize<BR>rlm_ldap: performing user authorization for
testing<BR>radius_xlat: '(cn=testing)'<BR>radius_xlat:
'ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU'<BR>rlm_ldap: ldap_get_conn: Checking Id:
0<BR>rlm_ldap: ldap_get_conn: Got Id: 0<BR>rlm_ldap: attempting LDAP
reconnection<BR>rlm_ldap: (re)connect to xxxx1.xxxx2.EDU:389, authentication
0<BR>rlm_ldap: bind as superuser<A
href="mailto:superuser@xxxx1.xxxx2.edu/password">@xxxx1.xxxx2.edu/password</A>
to xxxx1.xxxx2.EDU:389<BR>rlm_ldap: waiting for bind result ...<BR>rlm_ldap:
Bind was successful<BR>rlm_ldap: performing search in
ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU, with filter (cn=testing)<BR>rlm_ldap: looking
for check items in directory...<BR>rlm_ldap: looking for reply items in
directory...<BR>rlm_ldap: user testing authorized to use remote
access<BR>rlm_ldap: ldap_release_conn: Release Id: 0<BR>
modcall[authorize]: module "ldap" returns ok for request 0<BR>modcall: group
authorize returns ok for request 0<BR> rad_check_password: Found
Auth-Type System<BR>auth: type "System"<BR> Processing the authenticate
section of radiusd.conf<BR>modcall: entering group authenticate for request
0<BR> modcall[authenticate]: module "unix" returns notfound for request
0<BR>modcall: group authenticate returns notfound for request 0<BR>auth: Failed
to validate the user.<BR>Delaying request 0 for 1 seconds<BR>Finished request
0<BR>Going to the next request<BR>Thread 1 waiting to be assigned a
request<BR>rad_recv: Access-Request packet from host 10.1.1.27:32803, id=121,
length=59<BR>Sending Access-Reject of id 121 to 10.1.1.27:32803<BR>--- Walking
the entire request list ---<BR>Waking up in 3 seconds...<BR>--- Walking the
entire request list ---<BR>Cleaning up request 0 ID 121 with timestamp
43c2d99f<BR>Nothing to do. Sleeping until we see a
request.</SPAN></FONT></DIV></BODY></HTML>