<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:14pt"><DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">I tried updating to version 2.0. I like the debug interface much better, it makes it alot easier to read. Nice job!</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">Unfortunately, this upgrade introduced a new issue for me. When doing group ldap searches, it looks like the Ldap-UserDN variable doesn't get populated. The server successfully binds and finds the user, but in the expand section:</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: ldap_release_conn: Release Id: 0</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> expand: (|(&objectClass=GroupOfNames)(member=%{Ldap-UserDN}))(&objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDN})))->(|(&objectClass=GroupOfNames)(member=))(&(objectClass=GrouOfUniqueNames)(uniquemember=)))</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">It then fails to find the ldap group, because of the member= and uniquemember= are blank. A few lines below that, though, it comes up with the correct full DN search:</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: performing search in cn=somegroup,ou=something,ou=something with filter (|(&objectClass=GroupOfNames)(member=))(&(objectClass=GrouOfUniqueNames)(uniquemember=)))</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: object not found or got ambigous search result</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: ldap_release_conn: Release Id: 0</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: ldap_get_conn: Checking Id: 0</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: ldap_get_conn: Got Id: 0</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap: performing serach in cn=xxx,ou=something,ou=something with filter (objectclass=*)</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">rlm_ldap::ldap_groupcmp: ldap_get_values failed</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">I tried using my old config from 1.1, as well as re-writing it, as well as using the new and old ldap.attrmap. This is verified to work in version 1.1 for me.</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif">This is against eDirectory, configured with the --with-edir option</DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"><BR><BR> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">----- Original Message ----<BR>From: Alan DeKok <aland@deployingradius.com><BR>To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org><BR>Sent: Saturday, January 12, 2008 3:40:39 AM<BR>Subject: Re: LDAP Groups and EAP<BR><BR>Brian Wilson wrote:<BR>> I am running Freeradius 1.1.0<BR><BR> Please upgrade to at least 1.1.7. It solves a lot of security issues,<BR>*and* helps with the problem you're seeing, too.<BR><BR>> When I try to authenticate, the radius server receives about 7<BR>> Access-requests.<BR><BR> That's the way EAP works.<BR><BR>> Notice that there is no additional call to ldap_group between the<BR>> authorize and the resulting failure in the files module.<BR><BR> The *inner* tunnel session doesn't match a huntgroup.<BR><BR>>
Is there something i'm missing in the configuration file?<BR><BR> I would suggest trying 2.0. The new virtual server feature should<BR>make this configuration much simpler. The new "unlang" feature should<BR>also simplify the writing of policies.<BR><BR> Alan DeKok.<BR>-<BR>List info/subscribe/unsubscribe? See <A href="http://www.freeradius.org/list/users.html" target=_blank>http://www.freeradius.org/list/users.html</A><BR></DIV>
<DIV style="FONT-SIZE: 14pt; FONT-FAMILY: times new roman, new york, times, serif"><BR></DIV></div><br>
<hr size=1>Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. <a href="http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ "> Try it now.</a></body></html>