<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hi,<BR>
<BR>
I read that, but what if user not found in ldap? Radius seems to need<BR>
some auth-type. How i can force auth-type using ldap?<BR>
<BR>
My radius gives this message -> "No authenticate method (Auth-Type)<BR>
configuration found for the request: Rejecting the user"<BR>
<BR>
Here is some other logs if i use only ldap for authorize section:<BR>
<BR>
rad_recv: Access-Request packet from host 10.10.1.100 port 1024, id=198, length=224<BR>
Framed-MTU = 1466<BR>
NAS-IP-Address = 10.10.1.100<BR>
NAS-Identifier = "8021x"<BR>
User-Name = "lnx01.demo.local"<BR>
Service-Type = Framed-User<BR>
Framed-Protocol = PPP<BR>
NAS-Port = 37<BR>
NAS-Port-Type = Ethernet<BR>
NAS-Port-Id = "37"<BR>
Called-Station-Id = "00-16-b9-55-48-c0"<BR>
Calling-Station-Id = "00-e0-00-1c-1e-c1"<BR>
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"<BR>
Tunnel-Type:0 = VLAN<BR>
Tunnel-Medium-Type:0 = IEEE-802<BR>
Tunnel-Private-Group-Id:0 = "1"<BR>
EAP-Message = 0x02330016017375736530312e64656d6f2e6c6f63616c<BR>
Message-Authenticator = 0x5c313918e00d0d385d435e3194c284ed<BR>
+- entering group authorize {...}<BR>
++[preprocess] returns ok<BR>
[suffix] No '@' in User-Name = "lnx01.demo.local", looking up realm NULL<BR>
[suffix] No such realm "NULL"<BR>
++[suffix] returns noop<BR>
[files] users: Matched entry DEFAULT at line 190<BR>
++[files] returns ok<BR>
[ldap] performing user authorization for lnx01.demo.local<BR>
[ldap] expand: (cn=%u) -> (cn=lnx01.demo.local)<BR>
[ldap] expand: ou=8021x,dc=demo,dc=local -> ou=8021x,dc=demo,dc=local<BR>
rlm_ldap: ldap_get_conn: Checking Id: 0<BR>
rlm_ldap: ldap_get_conn: Got Id: 0<BR>
rlm_ldap: attempting LDAP reconnection<BR>
rlm_ldap: (re)connect to 10.10.101.31:389, authentication 0<BR>
rlm_ldap: setting TLS CACert Directory to /path/to/ca/dir/<BR>
rlm_ldap: bind as cn=Directory Manager/ to 10.10.101.31:389<BR>
rlm_ldap: waiting for bind result ...<BR>
request done: ld 0x9ba2480 msgid 1<BR>
rlm_ldap: Bind was successful<BR>
rlm_ldap: performing search in ou=8021x,dc=demo,dc=local, with filter (cn=lnx01.demo.local)<BR>
request done: ld 0x9ba2480 msgid 2<BR>
[ldap] looking for check items in directory...<BR>
[ldap] looking for reply items in directory...<BR>
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?<BR>
[ldap] user suse01.demo.local authorized to use remote access<BR>
rlm_ldap: ldap_release_conn: Release Id: 0<BR>
++[ldap] returns ok<BR>
++[expiration] returns noop<BR>
++[logintime] returns noop<BR>
No authenticate method (Auth-Type) configuration found for the request: Rejecting the user<BR>
Failed to authenticate the user.<BR>
Login incorrect: [suse01.demo.local/<no User-Password attribute>] (from client 8021x port 37 cli 00-e0-00-1c-1e-c1)<BR>
Using Post-Auth-Type Reject<BR>
+- entering group REJECT {...}<BR>
[attr_filter.access_reject] expand: %{User-Name} -> suse01.demo.local<BR>
attr_filter: Matched entry DEFAULT at line 11<BR>
++[attr_filter.access_reject] returns updated<BR>
Delaying reject of request 0 for 1 seconds<BR>
Going to the next request<BR>
Waking up in 0.9 seconds.<BR>
Sending delayed reject for request 0<BR>
Sending Access-Reject of id 198 to 10.10.1.100 port 1024<BR>
Waking up in 4.9 seconds.<BR>
Cleaning up request 0 ID 198 with timestamp +6<BR>
Ready to process requests.<BR>
<BR>
Br,<BR>
<BR>
Ville<BR>
<BR>
>We have openldap which includes our machine accounts. We<BR>
>have also computer certificates. Now what i want to do that freeradius,<BR>
>checks authorization against ldap and authenticate against certificates.<BR>
><BR>
>I have tested to put ldap to authorization section and eap to authentication<BR>
>section, but this wont work. I have also tested to put both ldap and eap to<BR>
>authorization section, but ldap wont return reject if user's noot found.<BR>
><BR>
>Is there any method to return reject for authorization section if user not<BR>
>found in ldap and stop processing there? Or is there any other method to do this?<BR>
><BR>
<BR>
>Read doc/rlm_ldap about access_attr.<BR>
<BR>
>Ivan Kalik<BR>
>Kalik Informatika ISP<BR>
</FONT>
</P>
</BODY>
</HTML>