<div> </div><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">I think there might be actually; you have:<br><br>
groupmembership_filter = "...(member=%{Ldap-UserDn}..."<br><br>
...but the default/sample configs that come with the server have:<br><br>
groupmembership_filter = "...(member=%{control:Ldap-UserDn}..."<br><br><br>
That "control:" is important. Which version of the server are you using
and where did you get the configs from? If you replace "Ldap-UserDn"
with "control:Ldap-UserDn" (it appears twice in the group filter) does
it work?<br></blockquote>
<br>Good eye Phil, I had a look and the LDAP module configuration was correct, but as it turns out the Group membership checking was disabled. I did a quick test and that seems to be some default query that comes up if you have the Group membership checking disabled. I must have disabled this last night when I was messing around with it. <br>
<br><br><br>Also I asked one of the admins at work today to take a look at our LDAP with me and our group object/name is actually posixGroup, so I updated the groupmembership_filter and re-enabled the Group membership checking as below... <br>
<br><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">groupname_attribute = cn<br>groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=posixGroup)(memberUid=%{control:Ldap-UserDN}))"<br>
groupmembership_attribute = radiusGroupName<br clear="all"></blockquote><br>Attached is a debug log of my logon attempts with these settings, which still fails unfortunately. <br><br><br><br><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">
<blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">being in the group that is definitely the case, I have verified this<br>
locally on the system, and the Group-Name comparison in Users succeeds<br>
for this case.<br></blockquote></blockquote><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote"><br>Really? Hmm.<br></blockquote><br>I checked this whilst looking at the LDAP group object/name stuff today and my user account is definitely a member of the 'net_su' group, I also checked that I can still very this from the groups commands on LDAP connected systems and that the Users configuration file using this as a check item still works. <br>
<br><br><br><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">If you can query LDAP directly, do so. Do not use rlm_unix for LDAP queries, even if nssswitch is setup for it.<br>
</blockquote><br>Noted, are you able to elaborate on why this is the case though, just like to understand, only if its not too much trouble though. <br><br><br>Regards<br>Cam. <br>--<br><br><br><br><br><br>
<br><br><div class="gmail_quote">On Mon, Sep 27, 2010 at 17:53, Phil Mayers <span dir="ltr"><<a href="mailto:p.mayers@imperial.ac.uk">p.mayers@imperial.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">On 09/27/2010 01:09 AM, Cameron Wood wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
Are we talking about Group-Name (which is implemented by the "unix"<br>
module and comes from /etc/group) or Ldap-Group (which is<br>
implemented by the ldap module and comes from ldap lookups)?<br>
Both implement their own == hooks so the same constraints apply, but<br>
the difference is relevant of course!<br>
<br>
<br>
I honestly don't know which one I should be using; the information is in<br>
LDAP, the local system is configured for LDAP and issuing the groups<br>
command returns the local and LDAP groups the user is assigned to. Would<br>
this suggest that I could just use Group-Name, making use of the unix<br>
module?<br>
</blockquote>
<br></div>
If you can query LDAP directly, do so. Do not use rlm_unix for LDAP queries, even if nssswitch is setup for it.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
<br>
Below you show an attempt to match both in turn. For Group-Name, the<br>
comparison seems to fail; implying that either the "unix" module<br>
isn't configured/loaded or the username isn't in the group you're<br>
matching.<br>
<br>
<br>
I read through the debug log to check that the unix module is getting<br>
loaded, which it appears to be, I'm not aware of any configuration that<br>
needs to be provided for that module, is there any? As for the user<br>
</blockquote>
<br></div>
No. As long as the module is being instantiated (which it is) then Group-Name should work.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
being in the group that is definitely the case, I have verified this<br>
locally on the system, and the Group-Name comparison in Users succeeds<br>
for this case.<br>
</blockquote>
<br></div>
Really? Hmm.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
<br>
If you are trying to match (ldap) Ldap-Group, you will need to<br>
ensure that the LDAP directory is correctly populated.<br>
<br>
<br>
This I am looking into, to my knowledge it is correctly setup as there<br>
are lots of other systems around our organisation that are referencing<br>
this successfully, but I wonder if the LDAP module is configured<br>
correctly, maybe there is a problem with the search string/query?<br>
</blockquote>
<br></div>
I think there might be actually; you have:<br>
<br>
groupmembership_filter = "...(member=%{Ldap-UserDn}..."<br>
<br>
...but the default/sample configs that come with the server have:<br>
<br>
groupmembership_filter = "...(member=%{control:Ldap-UserDn}..."<br>
<br>
<br>
That "control:" is important. Which version of the server are you using and where did you get the configs from? If you replace "Ldap-UserDn" with "control:Ldap-UserDn" (it appears twice in the group filter) does it work?<div>
<div></div><div class="h5"><br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br>