<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
<p style="margin-bottom: 0cm; margin-top: 0pt;">Hi,</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;"><br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">Version:
freeradius-1.1.3-1.2.el5.x86_64</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;"><br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">I am trying to use
Radius to authenticate via our Linux OpenLDAP Server.</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">(currently users
authenticate successfully via ssh etc)<br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;"><br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">I have tried many
different configurations, but all results with:</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">....<br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">rlm_ldap: waiting for
bind result ...<br>
rlm_ldap: Bind failed with invalid credentials<br>
modcall[authenticate]: module "ldap" returns reject for request 0<br>
modcall: leaving group LDAP (returns reject) for request 0<br>
auth: Failed to validate the user.</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">....</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;"><br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">I would really
appreciate getting help on getting this working.<br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;"><br>
</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">[root@fs1 ~]#
/usr/sbin/radiusd -X -A</p>
<p style="margin-bottom: 0cm; margin-top: 0pt;">Starting - reading
configuration files ...<br>
reread_config: reading radiusd.conf<br>
Config: including file: /etc/raddb/proxy.conf<br>
Config: including file: /etc/raddb/clients.conf<br>
Config: including file: /etc/raddb/snmp.conf<br>
Config: including file: /etc/raddb/eap.conf<br>
main: prefix = "/usr"<br>
main: localstatedir = "/var"<br>
main: logdir = "/var/log/radius"<br>
main: libdir = "/usr/lib64"<br>
main: radacctdir = "/var/log/radius/radacct"<br>
main: hostname_lookups = no<br>
main: snmp = no<br>
main: max_request_time = 30<br>
main: cleanup_delay = 5<br>
main: max_requests = 1024<br>
main: delete_blocked_requests = 0<br>
main: port = 0<br>
main: allow_core_dumps = no<br>
main: log_stripped_names = no<br>
main: log_file = "/var/log/radius/radius.log"<br>
main: log_auth = no<br>
main: log_auth_badpass = no<br>
main: log_auth_goodpass = no<br>
main: pidfile = "/var/run/radiusd/radiusd.pid"<br>
main: user = "radiusd"<br>
main: group = "radiusd"<br>
main: usercollide = no<br>
main: lower_user = "no"<br>
main: lower_pass = "no"<br>
main: nospace_user = "no"<br>
main: nospace_pass = "no"<br>
main: checkrad = "/usr/sbin/checkrad"<br>
main: proxy_requests = yes<br>
proxy: retry_delay = 5<br>
proxy: retry_count = 3<br>
proxy: synchronous = no<br>
proxy: default_fallback = yes<br>
proxy: dead_time = 120<br>
proxy: post_proxy_authorize = no<br>
proxy: wake_all_if_all_dead = no<br>
security: max_attributes = 200<br>
security: reject_delay = 1<br>
security: status_server = no<br>
main: debug_level = 0<br>
read_config_files: reading dictionary<br>
read_config_files: reading naslist<br>
Using deprecated naslist file. Support for this will go away soon.<br>
read_config_files: reading clients<br>
read_config_files: reading realms<br>
radiusd: entering modules setup<br>
Module: Library search path is /usr/lib64<br>
Module: Loaded exec <br>
exec: wait = yes<br>
exec: program = "(null)"<br>
exec: input_pairs = "request"<br>
exec: output_pairs = "(null)"<br>
exec: packet_type = "(null)"<br>
rlm_exec: Wait=yes but no output defined. Did you mean output=none?<br>
Module: Instantiated exec (exec) <br>
Module: Loaded expr <br>
Module: Instantiated expr (expr) <br>
Module: Loaded LDAP <br>
ldap: server = "172.16.16.5"<br>
ldap: port = 389<br>
ldap: net_timeout = 1<br>
ldap: timeout = 4<br>
ldap: timelimit = 3<br>
ldap: identity = ""<br>
ldap: tls_mode = no<br>
ldap: start_tls = no<br>
ldap: tls_cacertfile = "(null)"<br>
ldap: tls_cacertdir = "(null)"<br>
ldap: tls_certfile = "(null)"<br>
ldap: tls_keyfile = "(null)"<br>
ldap: tls_randfile = "(null)"<br>
ldap: tls_require_cert = "allow"<br>
ldap: password = ""<br>
ldap: basedn = "ou=People,dc=istraresearch,dc=com"<br>
ldap: filter =
"(&(objectClass=inetOrgPerson)(uid=%{Stripped-User-Name:-%{User-Name}}))"<br>
ldap: base_filter = "(objectclass=radiusprofile)"<br>
ldap: default_profile = "(null)"<br>
ldap: profile_attribute = "(null)"<br>
ldap: password_header = "{MD5}" ---> <br>
ldap: password_attribute = "userPassword"<br>
ldap: access_attr = "(null)"<br>
ldap: groupname_attribute = "cn"<br>
ldap: groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"<br>
ldap: groupmembership_attribute = "(null)"<br>
ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap"<br>
ldap: ldap_debug = 0<br>
ldap: ldap_connections_number = 5<br>
ldap: compare_check_items = no<br>
ldap: access_attr_used_for_allow = yes<br>
ldap: do_xlat = yes<br>
ldap: set_auth_type = yes<br>
rlm_ldap: Registering ldap_groupcmp for Ldap-Group<br>
rlm_ldap: Registering ldap_xlat with xlat_name ldap<br>
rlm_ldap: reading ldap<->radius mappings from file
/etc/raddb/ldap.attrmap<br>
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$<br>
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$<br>
rlm_ldap: LDAP userPassword mapped to RADIUS Crypt-Password<br>
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type<br>
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use<br>
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id<br>
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS
Calling-Station-Id<br>
rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password<br>
rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password<br>
rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT<br>
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration<br>
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address<br>
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type<br>
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol<br>
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address<br>
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask<br>
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route<br>
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing<br>
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id<br>
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU<br>
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS
Framed-Compression<br>
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host<br>
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service<br>
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port<br>
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number<br>
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id<br>
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS
Framed-IPX-Network<br>
rlm_ldap: LDAP radiusClass mapped to RADIUS Class<br>
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout<br>
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout<br>
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS
Termination-Action<br>
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service<br>
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node<br>
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group<br>
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS
Framed-AppleTalk-Link<br>
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS
Framed-AppleTalk-Network<br>
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS
Framed-AppleTalk-Zone<br>
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit<br>
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port<br>
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message<br>
conns: 0x2ab0eb99fc80<br>
Module: Instantiated ldap (ldap) <br>
Module: Loaded radutmp <br>
radutmp: filename = "/var/log/radius/radutmp"<br>
radutmp: username = "%{User-Name}"<br>
radutmp: case_sensitive = no<br>
radutmp: check_with_nas = yes<br>
radutmp: perm = 384<br>
radutmp: callerid = yes<br>
Module: Instantiated radutmp (radutmp) <br>
Listening on authentication *:1812<br>
Listening on accounting *:1813<br>
Ready to process requests.<br>
-----------------------------<br>
<br>
<br>
rad_recv: Access-Request packet from host 172.16.16.55:36829, id=108,
length=60<br>
User-Name = "laurence"<br>
User-Password = "xxxx"<br>
NAS-IP-Address = 255.255.255.255<br>
NAS-Port = 1<br>
Processing the authorize section of radiusd.conf<br>
modcall: entering group authorize for request 0<br>
rlm_ldap: - authorize<br>
rlm_ldap: performing user authorization for laurence<br>
radius_xlat: '(&(objectClass=inetOrgPerson)(uid=laurence))'<br>
radius_xlat: 'ou=People,dc=istraresearch,dc=com'<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: attempting LDAP reconnection<br>
rlm_ldap: (re)connect to 172.16.16.5:389, authentication 0<br>
rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow<br>
rlm_ldap: bind as / to 172.16.16.5:389<br>
rlm_ldap: waiting for bind result ...<br>
rlm_ldap: Bind was successful<br>
rlm_ldap: performing search in ou=People,dc=istraresearch,dc=com, with
filter (&(objectClass=inetOrgPerson)(uid=laurence))<br>
rlm_ldap: looking for check items in directory...<br>
rlm_ldap: looking for reply items in directory...<br>
rlm_ldap: Setting Auth-Type = ldap<br>
rlm_ldap: user laurence authorized to use remote access<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
modcall[authorize]: module "ldap" returns ok for request 0<br>
modcall: leaving group authorize (returns ok) for request 0<br>
rad_check_password: Found Auth-Type ldap<br>
auth: type "LDAP"<br>
Processing the authenticate section of radiusd.conf<br>
modcall: entering group LDAP for request 0<br>
rlm_ldap: - authenticate<br>
rlm_ldap: login attempt by "laurence" with password "xxxx"<br>
rlm_ldap: user DN: cn=Laurence Mayer,ou=people,dc=istraresearch,dc=com<br>
rlm_ldap: (re)connect to 172.16.16.5:389, authentication 1<br>
rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow<br>
rlm_ldap: bind as cn=Laurence
Mayer,ou=people,dc=istraresearch,dc=com/xxxx to 172.16.16.5:389<br>
rlm_ldap: waiting for bind result ...<br>
rlm_ldap: Bind failed with invalid credentials<br>
modcall[authenticate]: module "ldap" returns reject for request 0<br>
modcall: leaving group LDAP (returns reject) for request 0<br>
auth: Failed to validate the user.<br>
Delaying request 0 for 1 seconds<br>
Finished request 0<br>
Going to the next request<br>
--- Walking the entire request list ---<br>
Waking up in 1 seconds...<br>
--- Walking the entire request list ---<br>
Waking up in 1 seconds...<br>
--- Walking the entire request list ---<br>
Sending Access-Reject of id 108 to 172.16.16.55 port 36829<br>
Waking up in 4 seconds...<br>
--- Walking the entire request list ---<br>
Cleaning up request 0 ID 108 with timestamp 48ba7d29<br>
Nothing to do. Sleeping until we see a request.<br>
<br>
</p>
<pre class="moz-signature" cols="72">Thanks
Laurence
</pre>
</body>
</html>