<div dir="ltr">Running version 2.0.5, with LDAP backend for authentication/authorization.<br><br>Needed functionality: A single user account needs a different ldap/radius profile depending on which huntgroup the request is coming in on... the reason is that each user has a different Framed-IP-Address for each VPN concentrator they are coming in on. So each user needs a profile per NAS, I believe.<br>
<br>I have separated out each NAS into its appropriate huntgroup, and am matching on that in the users file. Also trying to dynamically set the User-Profile.<br><br>DEFAULT Huntgroup-Name == jup-rtr-xauth, Ldap-Group == `cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=geowireless,dc=net`, User-Profile := `uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=geowireless,dc=net`<br>
Fall-Through = no<br><br>(entire users file at the end of this message).<br><br>The user is authenticated successfully (so the group matching and the %{Huntgroup-Name} expansion are working fine), but the User-Profile is not being set. If I hard code in the value for uid, it works, so the problem is in the variable.<br>
<br>radiusd -X output:<br><br>rad_recv: Access-Request packet from host <a href="http://192.168.17.1" target="_blank">192.168.17.1</a> port 57383, id=124, length=121<br> User-Name = "sbowman"<br> User-Password = "XXX"<br>
Acct-Session-Id = "NS-00000035"<br> NAS-IP-Address = <a href="http://192.168.17.1" target="_blank">192.168.17.1</a><br> NAS-Port = 24824<br> NAS-Port-Type = Virtual<br> Called-Station-Id = "<a href="http://75.145.224.194" target="_blank">75.145.224.194</a>"<br>
Calling-Station-Id = "<a href="http://140.32.244.99" target="_blank">140.32.244.99</a>"<br> Netscreen-Attr-10 = 0x00000003<br>+- entering group authorize<br> expand: %{Packet-Src-IP-Address} -> <a href="http://192.168.17.1" target="_blank">192.168.17.1</a><br>
++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br> rlm_realm: No '@' in User-Name = "sbowman", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br>
++[suffix] returns noop<br> rlm_eap: No EAP-Message, not doing EAP<br>++[eap] returns noop<br>rlm_ldap: Entering ldap_groupcmp()<br> expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net<br>WARNING: Deprecated conditional expansion ":-". See "man unlang" for details<br>
expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sbowman)<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to <a href="http://ldap.domain.net:389" target="_blank">ldap.domain.net:389</a>, authentication 0<br>
rlm_ldap: setting TLS CACert File to /etc/pki/tls/certs/ca-bundle.crt<br>rlm_ldap: starting TLS<br>request done: ld 0x84e1340 msgid 1<br>rlm_ldap: bind as uid=redpillradius,ou=Clients,dc=domain,dc=net/XXX to <a href="http://ldap.domain.net:389" target="_blank">ldap.domain.net:389</a><br>
rlm_ldap: waiting for bind result ...<br>request done: ld 0x84e1340 msgid 2<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (uid=sbowman)<br>request done: ld 0x84e1340 msgid 3<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br> expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet)))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (&(cn=disabled)(|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))))<br>
request done: ld 0x84e1340 msgid 4<br>rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>rlm_ldap::ldap_groupcmp: Group disabled not found or user is not a member.<br>
expand: cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=domain,dc=net -> cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net<br>rlm_ldap: Entering ldap_groupcmp()<br> expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net<br>
expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet)))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dsbowman\2cou\3dPeople\2cdc\3ddomain\2cdc\3dnet)))<br>
request done: ld 0x84e1340 msgid 5<br>rlm_ldap::ldap_groupcmp: User found in group cn=jup-rtr-xauth,ou=Groups,ou=Radius,dc=domain,dc=net<br>rlm_ldap: ldap_release_conn: Release Id: 0<br> users: Matched entry DEFAULT at line 209<br>
++[files] returns ok<br>rlm_ldap: - authorize<br>rlm_ldap: performing user authorization for sbowman<br>WARNING: Deprecated conditional expansion ":-". See "man unlang" for details<br> expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sbowman)<br>
expand: ou=People,dc=domain,dc=net -> ou=People,dc=domain,dc=net<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in ou=People,dc=domain,dc=net, with filter (uid=sbowman)<br>
request done: ld 0x84e1340 msgid 6<br>rlm_ldap: performing search in uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=domain,dc=net, with filter (objectclass=radiusprofile)<br>request done: ld 0x84e1340 msgid 7<br>
rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap: default_profile/user-profile search failed<br>rlm_ldap: looking for check items in directory...<br>rlm_ldap: looking for reply items in directory...<br>
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?<br>rlm_ldap: Setting Auth-Type = LDAP<br>rlm_ldap: user sbowman authorized to use remote access<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>++[expiration] returns noop<br>++[logintime] returns noop<br>rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this.<br>++[pap] returns noop<br>
rad_check_password: Found Auth-Type LDAP<br>auth: type "LDAP"<br>+- entering group LDAP<br>rlm_ldap: - authenticate<br>rlm_ldap: login attempt by "sbowman" with password "XXX"<br>rlm_ldap: user DN: uid=sbowman,ou=People,dc=domain,dc=net<br>
rlm_ldap: (re)connect to <a href="http://ldap.domain.net:389" target="_blank">ldap.domain.net:389</a>, authentication 1<br>rlm_ldap: setting TLS CACert File to /etc/pki/tls/certs/ca-bundle.crt<br>rlm_ldap: starting TLS<br>
request done: ld 0x8572fe0 msgid 1<br>
rlm_ldap: bind as uid=sbowman,ou=People,dc=domain,dc=net/XXX to <a href="http://ldap.domain.net:389" target="_blank">ldap.domain.net:389</a><br>rlm_ldap: waiting for bind result ...<br>request done: ld 0x8572fe0 msgid 2<br>
rlm_ldap: Bind was successful<br>
rlm_ldap: user sbowman authenticated succesfully<br>++[ldap] returns ok<br>Login OK: [sbowman] (from client jup-rtr-xauth port 24824 cli <a href="http://140.32.244.99" target="_blank">140.32.244.99</a>)<br>+- entering group post-auth<br>
++[exec] returns noop<br>Sending Access-Accept of id 124 to <a href="http://192.168.17.1" target="_blank">192.168.17.1</a> port 57383<br>Finished request 1.<br><br><br>------ users -----<br><br>DEFAULT Ldap-Group == disabled, Auth-Type := Reject<br>
Reply-Message = "Account disabled. Please call the helpdesk."<br><br>DEFAULT Huntgroup-Name == jup-rtr-xauth, Ldap-Group == `cn=%{Huntgroup-Name},ou=Groups,ou=Radius,dc=geowireless,dc=net`, User-Profile := `uid=%{User-Name},ou=jup-rtr-xauth,ou=Profiles,ou=Radius,dc=geowireless,dc=net`<br>
Fall-Through = no<br><br>DEFAULT Huntgroup-Name == jup-rtr-xauth, Auth-Type := Reject<br> Reply-Message = "Not authorized for XAuth access. Please call the helpdesk.",<br> Fall-Through = no<br>
<br>DEFAULT Auth-Type := Reject<br> Reply-Message = "Please call the helpdesk."<br><br>-----------------<br><br><br></div>