<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1528" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hy all,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I have configured my LDAP server with the following
control access. In the slapd.conf:</FONT></DIV>
<DIV>
<P class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; mso-pagination: none; mso-layout-grid-align: none"><SPAN
lang=EN-GB
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"></SPAN> </P>
<P class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; mso-pagination: none; mso-layout-grid-align: none"><SPAN
lang=EN-GB
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB">access to
*<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office"
/><o:p></o:p></SPAN></P>
<P class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; mso-pagination: none; mso-layout-grid-align: none"><SPAN
lang=EN-GB
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
style="mso-spacerun: yes"> </SPAN>by self
write<o:p></o:p></SPAN></P>
<P class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; mso-pagination: none; mso-layout-grid-align: none"><SPAN
lang=EN-GB
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
style="mso-spacerun: yes"> </SPAN>by
dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com"
write<o:p></o:p></SPAN></P>
<P class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; mso-pagination: none; mso-layout-grid-align: none"><SPAN
lang=EN-GB
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
style="mso-spacerun: yes"> </SPAN>by
anonymous auth<o:p></o:p></SPAN></P><SPAN lang=EN-GB
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB; mso-fareast-font-family: 'Times New Roman'; mso-fareast-language: ES; mso-bidi-language: AR-SA"><SPAN
style="mso-spacerun: yes"> </SPAN>by * none
</SPAN></DIV>
<DIV><FONT face=Arial
size=2>---------------------------------------</FONT></DIV>
<DIV><FONT face=Arial size=2>My users file:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>DEFAULT Ldap-Group == isdn, NAS-Port == 58,
User-Profile := "uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com"</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>DEFAULT Auth-Type :=
Reject<BR> Reply-Message = "Llamse a
servicio tecnico" </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial
size=2>-------------------------------------------</FONT></DIV>
<DIV><FONT face=Arial size=2>My directory:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>dn: dc=mydomain,dc=com<BR>objectclass:
dcObject<BR>objectclass: organizationalUnit<BR>ou: Mydomain.com Radius<BR>dc:
mydomain</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn: ou=radius,dc=mydomain,dc=com<BR>objectclass:
organizationalUnit<BR>ou: radius</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
ou=profiles,ou=radius,dc=mydomain,dc=com<BR>objectclass:
organizationalUnit<BR>ou: profiles</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
ou=users,ou=radius,dc=mydomain,dc=com<BR>objectclass: organizationalUnit<BR>ou:
users</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
ou=admins,ou=radius,dc=mydomain,dc=com<BR>objectclass: organizationalUnit<BR>ou:
admins</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com<BR>objectclass:
radiusprofile<BR>uid: dial<BR>radiusServiceType:
Framed-User<BR>radiusFramedProtocol: PPP<BR>radiusFramedIPNetmask:
255.255.255.0<BR>radiusFramedRouting: None</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com<BR>objectclass:
radiusprofile<BR>uid: isdn<BR>radiusServiceType:
Framed-User<BR>radiusFramedProtocol: PPP<BR>radiusFramedIPNetmask:
255.255.254.0<BR>radiusFramedRouting: None</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
uid=example,ou=users,ou=radius,dc=mydomain,dc=com<BR>objectclass:
radiusprofile<BR>uid: example<BR>userPassword: test<BR>radiusGroupName:
dial<BR>radiusGroupName: isdn</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com<BR>objectclass:
person<BR>sn: freeradius<BR>cn: freeradius<BR>userPassword:
freeradius</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com<BR>objectclass: person<BR>sn:
billing <BR>cn: billing <BR>userPassword: billing</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>dn:
cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com<BR>objectclass: person<BR>sn:
replica<BR>cn: replica<BR>userPassword: replica </FONT></DIV>
<DIV><FONT face=Arial
size=2>------------------------------------------------</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>When I try to authorize a user, it
fails:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>rad_recv: Access-Request packet from host
127.0.0.1:39035, id=223, length=59<BR>
User-Name = "example"<BR>
User-Password = "test"<BR>
NAS-IP-Address = xx.yy.cc.vv<BR>
NAS-Port = 58<BR> Processing the authorize section of
radiusd.conf<BR>modcall: entering group authorize for request 0<BR>
modcall[authorize]: module "preprocess" returns ok for request 0<BR>
modcall[authorize]: module "chap" returns noop for request 0<BR>
modcall[authorize]: module "mschap" returns noop for request
0<BR> rlm_realm: No <A href="mailto:'@'">'@'</A> in User-Name
= "example", looking up realm NULL<BR> rlm_realm: No such
realm "NULL"<BR> modcall[authorize]: module "suffix" returns noop for
request 0<BR> rlm_eap: No EAP-Message, not doing EAP<BR>
modcall[authorize]: module "eap" returns noop for request 0<BR>rlm_ldap:
Entering ldap_groupcmp()<BR>radius_xlat:
'ou=users,ou=radius,dc=mydomain,dc=com'<BR>radius_xlat:
'(uid=example)'<BR>rlm_ldap: ldap_get_conn: Checking Id: 0<BR>rlm_ldap:
ldap_get_conn: Got Id: 0<BR>rlm_ldap: attempting LDAP reconnection<BR>rlm_ldap:
(re)connect to localhost:389, authentication 0<BR>rlm_ldap: bind as / to
localhost:389<BR>rlm_ldap: waiting for bind result ...<BR>rlm_ldap: Bind was
successful<BR>rlm_ldap: performing search in
ou=users,ou=radius,dc=mydomain,dc=com, with filter (uid=example)<BR>rlm_ldap:
object not found or got ambiguous search result<BR><FONT
size=4>rlm_ldap::ldap_groupcmp: search failed<BR></FONT>rlm_ldap:
ldap_release_conn: Release Id: 0<BR> users: Matched entry
DEFAULT at line 3<BR> modcall[authorize]: module "files" returns ok for
request 0<BR>rlm_ldap: - authorize</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>If I remove the access control lines from
slapd.conf, it works well.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>What am I doing wrong?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Regards, </FONT></DIV>
<DIV><FONT face=Arial size=2>Rafa</FONT></DIV></BODY></HTML>