Hi,<br><br>I installed freeradius 2 but my problem is still there.<br>To remember it :<br><br>I configured Freeradius to look in openldap directory to authenticate and authorize an user.<br>
The authentication phase is OK<br>During
the authorize phase, a ldap search is done : if the user is member of a
group identified by the host ip he wants to connect, the user is
authorized.<br>The problem is here : freeradius receives an
Access-Request packet with a NAS-IP-Address (the good one) and to
search in the ldap, it doesn't send the ip received in the packet but
another one ! <br>
<br>Why this attribute is modified ?<br>Is there any cache (the other ip comes from another equipment) ?<br><br>To precize : <br>I think there is some cache enabled anywhere (the ip used for ldap filter is always the one of the first request), is there any way to disable it ?<br>
<br>Before testing, I created the group for IP1 and I added the test user to it.<br>Test 1:<br><ul><li>I ran radiusd -X</li><li>I try to connect with IP 1. => OK</li><li>I try to connect with IP 2 => OK (not right result because to check the membership it's the first IP which is used)</li>
</ul><br>Then, I kill radiusd.<br>test 2 :<br><ul><li>I ran radiusd -X</li><li>I try to connect with IP2 => KO (expected because the group for IP 2 doesn't exist)</li><li>I try to connect with IP1 => KO (not expected because the group for IP1 exists)</li>
</ul><br>To help, the logs :<br>------------------------------<br>rad_recv: Access-Request packet from host 126.50.0.148 port 1645, id=34, length=80<br> NAS-IP-Address = 126.50.0.148<br> NAS-Port = 1<br> NAS-Port-Type = Virtual<br>
User-Name = "testuser"<br> Calling-Station-Id = "126.100.100.6"<br> User-Password = "XXXXX"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>rlm_ldap: Entering ldap_groupcmp()<br>
[files] expand: dc=example,dc=com -> dc=example,dc=com<br>[files] expand: (uid=%{User-Name}) -> (uid=testuser)<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testuser)<br>
rlm_ldap: ldap_search() failed: LDAP connection lost.<br>rlm_ldap: Attempting reconnect<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: closing existing LDAP connection<br>rlm_ldap: (re)connect to localhost:389, authentication 0<br>
rlm_ldap: starting TLS<br>rlm_ldap: bind as ou=radius,ou=applications,dc=example,dc=com/XXXXX to localhost:389<br>rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testuser)<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>[files] expand: (&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:LDAP-UserDn})) -> (&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestuser\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in dc=example,dc=com, with filter (&(cn=126.50.0.147)(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestuser\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom)))<br>
rlm_ldap::ldap_groupcmp: User found in group 126.50.0.147<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>[files] users: Matched entry DEFAULT at line 1<br>++[files] returns ok<br>[ldap] performing user authorization for testuser<br>
[ldap] expand: (uid=%{User-Name}) -> (uid=testuser)<br>[ldap] expand: dc=example,dc=com -> dc=example,dc=com<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testuser)<br>
[ldap] looking for check items in directory...<br>[ldap] looking for reply items in directory...<br>WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?<br>[ldap] user testuser authorized to use remote access<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>++[ldap] returns ok<br>Found Auth-Type = LDAP<br>+- entering group LDAP {...}<br>[ldap] login attempt by "testuser" with password "azerty12"<br>[ldap] user DN: uid=testuser,uid=test01,ou=users,dc=example,dc=com<br>
rlm_ldap: (re)connect to localhost:389, authentication 1<br>rlm_ldap: starting TLS<br>rlm_ldap: bind as uid=testuser,uid=test01,ou=users,dc=example,dc=com/azerty12 to localhost:389<br>rlm_ldap: waiting for bind result ...<br>
rlm_ldap: Bind was successful<br>[ldap] user testuser authenticated succesfully<br>++[ldap] returns ok<br>Login OK: [testuser] (from client petitnom port 1 cli 126.100.100.6)<br>Sending Access-Accept of id 34 to 126.50.0.148 port 1645<br>
Nokia-IPSO-User-Role = "adminRole"<br> Nokia-IPSO-SuperUser-Access = 1<br> Service-Type = Login-User<br>Finished request 1.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>Cleaning up request 1 ID 34 with timestamp +52<br>
Ready to process requests.<br><br>------------------------------<br clear="all"><br>-- <br>KeV<br>