You may need to comment out the logintime and pap sections, since this isn't a pap authentication.<br><br>It seems like the password is being correctly extracted out of eDirectory using Universal Password, but are you sure that's properly configured in the build version of FreeRadius?<br>
<br><div class="gmail_quote">On Fri, Dec 10, 2010 at 11:40 AM, Robert Koskey <span dir="ltr"><<a href="mailto:rkoskey@rockyview.ab.ca">rkoskey@rockyview.ab.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div style="margin: 4px 4px 1px; font: 10pt Tahoma;">
<div>Can anyone help? We are trying to do a ldap authentication from novell's edirectory to an Aruba controller for wireless access. These are the error's we are getting.</div>
<div>It used to work perfectly but the original radius server blew up. We installed a new one with the same configuration and it doesn't work. The problem areas are bold'ed.</div>
<div>The problem seems to occur after the ldap authentication. I don't think we are entirely clear about the order in which the whole process happens. </div>
<div> </div>
<div>Any help or suggestions would be greatly appreciated.</div>
<div> </div>
<div>The set up is:</div>
<div>OpenSuse 11.0</div>
<div>FreeRadius 2.0.5</div>
<div> </div>
<div>We have tried:</div>
<div>OpenSuse 11.3</div>
<div>FreeRadius 2.1.9 (same result)</div>
<div> </div>
<div> </div>
<div>rad_recv: Access-Request packet from host 10.215.10.100 port 34806, id=218, length=199<br> User-Name = "jordanhkaltenbruner"<br> NAS-IP-Address = 10.200.8.30<br> NAS-Port = 2<br> NAS-Identifier = "10.215.10.99"<br>
NAS-Port-Type = Wireless-802.11<br> Calling-Station-Id = "78CA39B5D3E5"<br> Called-Station-Id = "000B8661AC58"<br> Service-Type = Login-User<br> Framed-MTU = 1100<br> EAP-Message = 0x02010018016a6f7264616e686b616c74656e6272756e6572<br>
Aruba-Essid-Name = "SCHS-Student"<br> Aruba-Location-Id = "SpringbankW2-9"<br> Message-Authenticator = 0x4542e9b98b5978ca1ca52b7617910620<br>+- entering group authorize<br>++[preprocess] returns ok<br>
++[chap] returns noop<br>++[mschap] returns noop<br> rlm_realm: No <a href="mailto:%27@%27" target="_blank">'@'</a> in User-Name = "jordanhkaltenbruner", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br>
++[suffix] returns noop<br>rlm_ldap: - authorize<br>rlm_ldap: performing user authorization for jordanhkaltenbruner<br>WARNING: Deprecated conditional expansion ":-". See "man unlang" for details<br> expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=jordanhkaltenbruner)<br>
expand: ou=springhigh_lab,o=springhigh -> ou=springhigh_lab,o=springhigh<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to <a href="http://10.215.0.3:636" target="_blank">10.215.0.3:636</a>, authentication 0<br>
rlm_ldap: setting TLS mode to 1<br>rlm_ldap: bind as cn=admin,o=springhigh/???? to <a href="http://10.215.0.3:636" target="_blank">10.215.0.3:636</a><br>rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>
rlm_ldap: performing search in ou=springhigh_lab,o=springhigh, with filter (uid=jordanhkaltenbruner)<br>rlm_ldap: Added the eDirectory password 51601222 in check items as Cleartext-Password<br>rlm_ldap: No default NMAS login sequence<br>
rlm_ldap: looking for check items in directory...<br>rlm_ldap: looking for reply items in directory...<br>rlm_ldap: user jordanhkaltenbruner authorized to use remote access<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br><b>++[expiration] returns noop<br>++[logintime] returns noop<br>rlm_pap: No clear-text password in the request. Not performing PAP.<br>++[pap] returns noop<br>auth: type Local<br>auth: No User-Password or CHAP-Password attribute in the request<br>
auth: Failed to validate the user.<br></b> Found Post-Auth-Type Reject<br>+- entering group REJECT<br> expand: %{User-Name} -> jordanhkaltenbruner<br> attr_filter: Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>
Sending Access-Reject of id 218 to 10.215.10.100 port 34806<br>Finished request 0.<br></div>
<div> </div>
<div> </div>
<div>Robert Koskey,</div>
<div>Systems and Network Manager</div>
<div> </div>
<div>Rocky View Schools</div>
<div>Telephone: 403-945-4080<br>Cell: 403-988-4640</div>
<div> </div>
<div> </div>
<div>Robert Koskey,</div>
<div>Systems and Network Manager</div>
<div> </div>
<div>Rocky View Schools</div>
<div>Telephone: 403-945-4080<br>Cell: 403-988-4640</div><br>
<p>
_____________________________________________________________________________________
</p>
<p>
This communication is intended for the use of the recipient to which it
is addressed, and may contain confidential, personal, and or privileged
information. Please contact us immediately if you are not the intended
recipient of this communication, and do not copy, distribute, or take
action relying on it. Any communication received in error, or subsequent
reply, should be deleted or destroyed.
</p>
</div>
<br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>