<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:14pt"><div>Hi all:<br><br> I am running Freeradius 1.1.0 and am trying to get Ldap-Groups to work with EAP/PEAP/MSCHAPv2, but have been running into issues. I'm trying to permit authentication to a wireless SSID based on an LDAP group. Here is my configuration:<br><br>Radiusd.conf:<br><br> authorize{<br> preprocess<br> auth_log<br> files {<br> notfound = return<br> }<br> eap<br> redundant-load-balance
{<br> ldap1<br> ldap2<br> }<br><br><br> authenticate {<br> Auth-Type LDAP {<br> redundant-load-balance {<br> ldap1<br> ldap2<br> }<br> Auth-Type EAP {<br> eap<br> }<br><br>hints:<br> DEFAULT
Called-Station-Id =~ ".*:ssid"<br> Called-Station-Id := "ssid"<br><br>huntgroups:<br> restrict Called-Station-Id == ssid<br> all NAS-IP-Address == xxx<br><br>users:<br> DEFAULT Huntgroup-Name == restrict, Ldap-group == "cn=something,ou=something"<br> DEFAULT Huntgroup-Name == all<br><br><br> When I try to authenticate, the radius server receives about 7 Access-requests. Each time it receives one, the Radius server checks the LDAP store to verify that the user exists in the ldap group (is this normal? can this be
reduced? 7 LDAP binds per authentication attempt seems high), and each module returns OK. On the 6th attempt though, it attempts to decode the EAP tunnel, and this happens:<br><br> rlm_dap::ldap_groupcmp: User found in group cn=something,ou=something<br>blah blah blah<br> Processing the authenticate section<br>blah blah blah<br> rlm_eap_peap: EAPTLS_OK<br> rlm_eap_peap: Session established. Decoding tunneled attributes.<br> rlm_eap_peap: Identity - XXX<br> rlm_eap_peap: Tunneled data is valid<br> PEAP: Got tunneled identity of XXX<br> PEAP: Setting default EAP type for tunneled EAP session<br> PEAP: Setting User-Name to
XXX<br> Processing the authorize section<br> modcall[authorize]: module "preprocess" returns ok for request 6<br>blah blah blah<br> modcall[authorize]: module "auth_log" returns ok for request 6<br> modcall[authorize]: module "files" returns notfound for request 6<br><br> Notice that there is no additional call to ldap_group between the authorize and the resulting failure in the files module. Since I have set "files { notfound = return}," the user fails to authenticate despite being accepted 5 times previously with ldap_group. If I remove "notfound = return", the user can authenticate REGARDLESS of the ldap-group I set, even when ldap_group returns notfound.<br><br> Is there something i'm missing in the configuration file? <br><br>
<br></div></div><br>
<hr size=1>Never miss a thing. <a href="http://us.rd.yahoo.com/evt=51438/*http://www.yahoo.com/r/hs"> Make Yahoo your homepage.</a>
</body></html>