We have tried to integrate OpenLDAP and FreeRadius. When we try to authenticate with the clients this is the error message:<br><br>Thu Jul 20 20:53:45 2006 : Info: Ready to process requests.<br>rad_recv: Access-Request packet from host
<a href="http://127.0.0.1:32801">127.0.0.1:32801</a>, id=0, length=217<br> User-Name = "misterc"<br> CHAP-Challenge = 0xa26932d73791f27d1314426f740ab34e<br> CHAP-Password = 0x002e07a2cc1f27e7fbd22e7bb3721a3986
<br> NAS-IP-Address = <a href="http://0.0.0.0">0.0.0.0</a><br> Service-Type = Login-User<br> Framed-IP-Address = <a href="http://192.168.182.2">192.168.182.2</a><br> Calling-Station-Id = "XX-XX-XX-XX-XX-XX"
<br> Called-Station-Id = "AA-AA-AA-AA-DD-AA"<br> NAS-Identifier = "nas01"<br> Acct-Session-Id = "44bfd15d00000000"<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 0
<br> Message-Authenticator = 0xf61479bee3c987c66cca254dcfa39c0a<br> WISPr-Logoff-URL = "<a href="http://192.168.182.1:3990/logoff">http://192.168.182.1:3990/logoff</a>"<br>Thu Jul 20 20:54:50 2006 : Debug: Processing the authorize section of
radiusd.conf<br>Thu Jul 20 20:54:50 2006 : Debug: modcall: entering group authorize for request 0<br>Thu Jul 20 20:54:50 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP
<br>Thu Jul 20 20:54:50 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0<br>Thu Jul 20 20:54:50 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0<br>Thu Jul 20 20:54:50 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0
<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: - authorize<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: performing user authorization for misterc<br>Thu Jul 20 20:54:50 2006 : Debug: radius_xlat: '(uid=misterc)'<br>Thu Jul 20 20:54:50 2006 : Debug: radius_xlat: 'ou=utenti,dc=XXXX,dc=it'
<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: attempting LDAP reconnection
<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: (re)connect to <a href="http://192.168.1.221:389">192.168.1.221:389</a>, authentication 0<br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: bind as / to <a href="http://192.168.1.221:389">
192.168.1.221:389</a><br>Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: waiting for bind result ...<br>Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: Bind was successful<br>Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: performing search in ou=utenti,dc=XXXX,dc=it, with filter (uid=misterc)
<br>Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: object not found or got ambiguous search result<br>Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: search failed<br>Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
<br>Thu Jul 20 20:54:51 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0<br>Thu Jul 20 20:54:51 2006 : Debug: modcall[authorize]: module "ldap" returns notfound for request 0<br>
Thu Jul 20 20:54:51 2006 : Debug: modcall: leaving group authorize (returns noop) for request 0<br>Thu Jul 20 20:54:51 2006 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
<br>Thu Jul 20 20:54:51 2006 : Debug: auth: Failed to validate the user.<br><br><br>This is the Radius configuration we are using:<br><br>my radius.conf<br><br>modules {<br> pap {<br> encryption_scheme = clear
<br> }<br> ldap {<br> server="<a href="http://192.168.1.221">192.168.1.221</a>"<br> port="389"<br> basedn="ou=utenti,dc=uniroma1,dc=it"
<br> filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"<br> start_tls = no<br> access_attr = "uid"<br> dictionary_mapping = ${raddbdir}/ldap.attrmap
<br> authtype = ldap<br> ldap_connections_number = 5<br> password_header = "{SHA}"<br> password_attribute = userPassword<br> }<br> }
<br><br>authorize {<br> eap<br> ldap<br> }<br>authenticate {<br> Auth-Type PAP {<br> pap<br> }<br> Auth-Type LDAP {<br> ldap
<br> }<br>}<br><br>And this is the my OpenLDAP directory (maybe can be useful):<br><br>My LDAP directory tree<br><br>dn: dc=xxxx,dc=it<br>dc: xxxx<br>objectClass: dcObject<br>objectClass: organizationalUnit
<br>ou: uniromaProject<br>structuralObjectClass: organizationalUnit<br>entryUUID: 8344c65e-aa07-102a-869a-1bfd23c6a14f<br>creatorsName: cn=Manager,dc=xxxx,dc=it<br>modifiersName: cn=Manager,dc=xxxx,dc=it<br>createTimestamp: 20060717174334Z
<br>modifyTimestamp: 20060717174334Z<br>entryCSN: 20060717174334Z#000000#00#000000<br><br>dn: dc=xxxx,dc=it<br>dc: xxxx<br>objectClass: dcObject<br>objectClass: organizationalUnit<br>ou: uniromaProject<br>structuralObjectClass: organizationalUnit
<br>entryUUID: 8344c65e-aa07-102a-869a-1bfd23c6a14f<br>creatorsName: cn=Manager,dc=xxxx,dc=it<br>modifiersName: cn=Manager,dc=xxxx,dc=it<br>createTimestamp: 20060717174334Z<br>modifyTimestamp: 20060717174334Z<br>entryCSN: 20060717174334Z#000000#00#000000
<br><br>dn: cn=Luca Ricci,ou=utenti,dc=xxxx,dc=it<br>uid: misterc<br>description: bel giovine<br>sn: Ricci<br>cn: newperson<br>cn: Luca Ricci<br>structuralObjectClass: inetOrgPerson<br>entryUUID: 729c0282-ab64-102a-8ceb-c14bbfafb8b4
<br>creatorsName: cn=Manager,dc=xxxx,dc=it<br>createTimestamp: 20060719112120Z<br>userPassword:: e1NIQX1TQ01UU1l5cVpESHcvSXhqRUJGWHdQQnFTTXM9<br>objectClass: radiusprofile<br>objectClass: inetOrgPerson<br>radiusAuthType: LDAP
<br>entryCSN: 20060719135155Z#000000#00#000000<br><br>If you need any other information please ask us; sorry if we are boring you but we are trying and trying without any significant result.<br>Thanks.<br><br><div><span class="gmail_quote">
On 7/20/06, <b class="gmail_sendername">Alan DeKok</b> <<a href="mailto:aland@nitros9.org">aland@nitros9.org</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
"Giuseppina Venezia" <<a href="mailto:giusy.venezia@gmail.com">giusy.venezia@gmail.com</a>> wrote:<br>> We need an exclusively web-based authentication for clients, avoiding the<br>> installation of external programs to check access like Xsupplicant. The
<br>> implementation works fine with a MySQL Database, but the question is if is<br>> possible realize the same implementation using OpenLDAP instead of MySQL<br>> keeping for clients the same web-based login criterions.
<br><br> Yes.<br><br> Alan DeKok.<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>