<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
First off I am totally new to radius...but really love the concept. I
have radius working with ldap to authorize the user if they are in the
corporate directory, o=lookout. My next step is to filter it by
category to the NAS device. I have been looking at quite a few
examples, but nothing seems to stick.<br>
<br>
In order for me to just grasp the concept, I have tried this in the
users file, o=lookout is our complete list of all of our users<br>
<br>
DEFAULT Huntgroup-Name == CiscoAdmin, Ldap-Group == "o=lookout"<br>
Fall-Through = no<br>
<br>
DEFAULT Auth-Type := Reject<br>
<br>
If I comment out the Reject, the user is able to authenticate to the
Cisco Router, as soon as uncomment it out, I get rejected...here is the
log file from it.<br>
<br>
<br>
<br>
Thu Jun 4 16:15:52 2009 : Info: [ldap] user daverummel authorized to
use remote access<br>
Thu Jun 4 16:15:52 2009 : Debug: rlm_ldap: ldap_release_conn: Release
Id: 0<br>
Thu Jun 4 16:15:52 2009 : Info: ++[ldap] returns ok<br>
Thu Jun 4 16:15:52 2009 : Info: ++[expiration] returns noop<br>
Thu Jun 4 16:15:52 2009 : Info: ++[logintime] returns noop<br>
Thu Jun 4 16:15:52 2009 : Info: Found Auth-Type = Reject<br>
Thu Jun 4 16:15:52 2009 : Info: Auth-Type = Reject, rejecting user<br>
Thu Jun 4 16:15:52 2009 : Info: Failed to authenticate the user.<br>
Thu Jun 4 16:15:52 2009 : Auth: Login incorrect: [daverummel] (from
client R1 port 98 cli 216.103.190.220)<br>
Thu Jun 4 16:15:52 2009 : Info: Using Post-Auth-Type Reject<br>
Thu Jun 4 16:15:52 2009 : Info: +- entering group REJECT {...}<br>
Thu Jun 4 16:15:52 2009 : Info: [attr_filter.access_reject] expand:
%{User-Name} -> daverummel<br>
Thu Jun 4 16:15:52 2009 : Debug: attr_filter: Matched entry DEFAULT
at line 11<br>
Thu Jun 4 16:15:52 2009 : Info: ++[attr_filter.access_reject] returns
updated<br>
Thu Jun 4 16:15:52 2009 : Info: Delaying reject of request 0 for 1
seconds<br>
Thu Jun 4 16:15:52 2009 : Debug: Going to the next request<br>
Thu Jun 4 16:15:52 2009 : Debug: Waking up in 0.9 seconds.<br>
Thu Jun 4 16:15:53 2009 : Info: Sending delayed reject for request 0<br>
<br>
<br>
The line I am really trying to understand is this one, where is this
line 11 ?<br>
<br>
<b>Thu Jun 4 16:15:52 2009 : Debug: attr_filter: Matched entry
DEFAULT at line 11<br>
<br>
</b>Thanks for your help<br>
<br>
Dave<br>
</body>
</html>