<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-AU link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hi all,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have been roped in to look over an issue we have with migrating
from Novell to AD.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>What we would like to do while we in the transitional phase
is check both the AD and Novell LDAP services for authorisation and
authentication (usernames are completely different so no need to be concerned
with username clashes). I have managed to setup authentication fall through
without any real issues, but, authorisation is having issues. Just to clarify,
if I only specify one of the LDAP servers everything works like a treat, so the
actual ldap server definitions are working fine in their own right.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>If I have the authorisation section setup:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>group LDAP {<o:p></o:p></p>
<p class=MsoNormal> vudc01 {<o:p></o:p></p>
<p class=MsoNormal>
notfound=2<o:p></o:p></p>
<p class=MsoNormal>
ok=return<o:p></o:p></p>
<p class=MsoNormal>
}<o:p></o:p></p>
<p class=MsoNormal>
novell {<o:p></o:p></p>
<p class=MsoNormal>
notfound=2<o:p></o:p></p>
<p class=MsoNormal>
ok=return<o:p></o:p></p>
<p class=MsoNormal>
}<o:p></o:p></p>
<p class=MsoNormal>}<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>(I have also tried variations without the group LDAP line)<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Things eventually fail and the last useful message (I think)
from –X –f is:<o:p></o:p></p>
<p class=MsoNormal>auth: No authenticate method (Auth-Type) configuration found
for the request: Rejecting the user<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>It’s not entirely clear what the freeradius LDAP
module is doing BUT it would appear that it looks over both authorisation assertions
and takes the one with least rights, but, I am not sure.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>As I stated earlier authentication fall through works like a
treat (if in the users file I don’t specify an LDAP-Group authentication
works). If I only specify 1 ldap server to do authentication and authorisation,
everything works, its only when I try to do authorisation via LDAP-Group AND
try to do authorisation fall through as documentation above do I start getting
errors.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Can anyone offer any advice or pointers?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Cheers,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Stewart<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>-X –f output:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>rad_recv: Access-Request packet from host 127.0.0.1:32909,
id=60, length=60<o:p></o:p></p>
<p class=MsoNormal> User-Name =
"USERNAME"<o:p></o:p></p>
<p class=MsoNormal> User-Password =
"PASSWORD"<o:p></o:p></p>
<p class=MsoNormal> NAS-IP-Address =
255.255.255.255<o:p></o:p></p>
<p class=MsoNormal> NAS-Port = 10<o:p></o:p></p>
<p class=MsoNormal> Processing the authorize section of radiusd.conf<o:p></o:p></p>
<p class=MsoNormal>modcall: entering group authorize for request 1<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "preprocess"
returns ok for request 1<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "chap" returns
noop for request 1<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "mschap" returns
noop for request 1<o:p></o:p></p>
<p class=MsoNormal> rlm_realm: No '@' in User-Name = "USERNAME",
looking up realm NULL<o:p></o:p></p>
<p class=MsoNormal> rlm_realm: No such realm "NULL"<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "suffix" returns
noop for request 1<o:p></o:p></p>
<p class=MsoNormal> rlm_eap: No EAP-Message, not doing EAP<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "eap" returns
noop for request 1<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: Entering ldap_groupcmp()<o:p></o:p></p>
<p class=MsoNormal>radius_xlat: 'o=vu '<o:p></o:p></p>
<p class=MsoNormal>radius_xlat: '(uid=UID)'<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: ldap_get_conn: Checking Id: 0<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: ldap_get_conn: Got Id: 0<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: performing search in o=vu, with filter (uid=USERNAME)<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: object not found or got ambiguous search result<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap::ldap_groupcmp: search failed<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: ldap_release_conn: Release Id: 0<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "files" returns
notfound for request 1<o:p></o:p></p>
<p class=MsoNormal>modcall: entering group redundant for request 1<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: - authorize<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: performing user authorization for USERNAME<o:p></o:p></p>
<p class=MsoNormal>radius_xlat: '(samaccountname=USERNAME)'<o:p></o:p></p>
<p class=MsoNormal>radius_xlat: 'dc=ad,dc=vu,dc=edu,dc=au'<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: ldap_get_conn: Checking Id: 0<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: ldap_get_conn: Got Id: 0<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: performing search in dc=ad,dc=vu,dc=edu,dc=au,
with filter (samaccountname=USERNAME)<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: No default NMAS login sequence<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: looking for check items in directory...<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: looking for reply items in directory...<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: user USERNAME authorized to use remote access<o:p></o:p></p>
<p class=MsoNormal>rlm_ldap: ldap_release_conn: Release Id: 0<o:p></o:p></p>
<p class=MsoNormal> modcall[authorize]: module "vudc01" returns
ok for request 1<o:p></o:p></p>
<p class=MsoNormal>modcall: leaving group redundant (returns ok) for
request 1<o:p></o:p></p>
<p class=MsoNormal>modcall: leaving group authorize (returns ok) for request 1<o:p></o:p></p>
<p class=MsoNormal>auth: No authenticate method (Auth-Type) configuration found
for the request: Rejecting the user<o:p></o:p></p>
<p class=MsoNormal>auth: Failed to validate the user.<o:p></o:p></p>
<p class=MsoNormal>Delaying request 1 for 1 seconds<o:p></o:p></p>
<p class=MsoNormal>Finished request 1<o:p></o:p></p>
<p class=MsoNormal>Going to the next request<o:p></o:p></p>
<p class=MsoNormal>--- Walking the entire request list ---<o:p></o:p></p>
<p class=MsoNormal>Waking up in 1 seconds...<o:p></o:p></p>
<p class=MsoNormal>--- Walking the entire request list ---<o:p></o:p></p>
<p class=MsoNormal>Waking up in 1 seconds...<o:p></o:p></p>
<p class=MsoNormal>--- Walking the entire request list ---<o:p></o:p></p>
<p class=MsoNormal>Sending Access-Reject of id 60 to 127.0.0.1 port 32909<o:p></o:p></p>
<p class=MsoNormal>Waking up in 4 seconds...<o:p></o:p></p>
<p class=MsoNormal>--- Walking the entire request list ---<o:p></o:p></p>
<p class=MsoNormal>Cleaning up request 1 ID 60 with timestamp 46c24e67<o:p></o:p></p>
<p class=MsoNormal>Nothing to do. Sleeping until we see a request.<o:p></o:p></p>
</div>
</body>
</html>