Hello everybody. I'll tell you what i wanna do and the problem i get so you could either fix my configuration or give me some new ideas. <br><br>First, I´m using freeradius 1.1.1 + ldap. <br><br>What I have is this: I have three radius working in different placement of one organization, these radius authorize against three subtrees of the ldap. When a user is not found they do proxy to another radius. This work quite well.
<br><br><br>What I want: I want to have another radius ( only one ) to acct as a backup of these servers ( for configuring my ciscos with two servers ). This radius has the complete tree but it must look in each subtree depending on the NAS-IP, not in the whole ldap. If the user is not found in the corresponding subtree it must do proxy to the central radius.
<br><br>I don't know if I have explain it correctly, if I haven't just tell me ( I'm not an english speaker )<br><br>For this configuration I've defined three ldaps in radiusd.conf:<br>module{<br> ldap ldap1{<br> }<br>
ldap ldap2{<br> }<br> ldap ldap3{<br> }<br>}<br>...<br>authorize{<br>...<br> autztype customer1{<br> redundant {<br> group {<br> ldap1 {
<br> notfound = return<br> fail = return<br> }<br> files<br> mschap
<br> eap<br> notfound = 1<br> fail = 1<br> }<br> files<br> }<br> }
<br> Autz-Type customer2{<br> [ similar configuration as above ]<br> }<br> Autz-Type customer3{<br> [ similar configuration as above ]<br> }<br>}<br><br><br>My hints file:<br><br>
DEFAULT NAS-IP-Address == "<a href="http://192.168.51.220">192.168.51.220</a>"<br> Autz-Type := customer1<br>DEFAULT NAS-IP-Address == "<a href="http://192.168.51.221">192.168.51.221</a>"<br> Autz-Type := customer2
<br>DEFAULT NAS-IP-Address == "<a href="http://192.168.51.222">192.168.51.222</a>"<br> Autz-Type := customer3<br><br><br><br>Users:<br>DEFAULT Proxy-to-realm := wickwar_central<br><br><br><br>The problem is that it doesn't execute any of Autz-Type sections.
<br><br>The logs:<br>rad_recv: Access-Request packet from host <a href="http://192.168.51.221:1645">192.168.51.221:1645</a>, id=200, length=160<br> User-Name = "cadiz"<br> Framed-MTU = 1400<br> Called-Station-Id = "
0011.9215.c490"<br> Calling-Station-Id = "0004.238d.4b0e"<br> Cisco-AVPair = "ssid=perfil_tipo_a"<br> Service-Type = Login-User<br> Message-Authenticator = 0x27c966f01f1de90c836066e2a019c553
<br> EAP-Message = 0x0202000a01636164697a<br> NAS-Port-Type = Wireless-802.11<br> Cisco-NAS-Port = "395"<br> NAS-Port = 395<br> NAS-IP-Address = <a href="http://192.168.51.221">
192.168.51.221</a><br> NAS-Identifier = "ap"<br> Processing the authorize section of radiusd.conf<br>modcall: entering group authorize for request 1<br> hints: Matched DEFAULT at 59<br> modcall[authorize]: module "preprocess" returns ok for request 1
<br> rlm_realm: No '/' in User-Name = "cadiz", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br> modcall[authorize]: module "ntdomain" returns noop for request 1<br>radius_xlat: '/opt/radius_LOCAL/var/log/radius/radacct/192.168.51.221/auth-detail-20060605'
<br>rlm_detail: /opt/radius_LOCAL/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/radius_LOCAL/var/log/radius/radacct/192.168.51.221/auth-detail-20060605<br> modcall[authorize]: module "auth_log" returns ok for request 1
<br>modcall: leaving group authorize (returns ok) for request 1<br>auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user<br>auth: Failed to validate the user.<br>Login incorrect: [cadiz/<no User-Password attribute>] (from client ap port 395 cli
0004.238d.4b0e)<br>Delaying request 1 for 1 seconds<br>Finished request 1<br>Going to the next request<br>--- Walking the entire request list ---<br>Waking up in 1 seconds...<br>--- Walking the entire request list ---<br>
Waking up in 1 seconds...<br>--- Walking the entire request list ---<br>Sending Access-Reject of id 200 to <a href="http://192.168.51.221">192.168.51.221</a> port 1645<br>Waking up in 4 seconds...<br>--- Walking the entire request list ---
<br>Cleaning up request 1 ID 200 with timestamp 44840b82<br>Nothing to do. Sleeping until we see a request.<br><br><br><br><br><br><br><br><br>If anyone could give my a hand. I would be grateful. <br>Thanks.<br><br> <br>