<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">On a test deployment I've both mysql and ntlm (AD) configured.<div><br></div><div>If I use EAP no problem to authenticate users on both backend.</div><div><br></div><div>But…in the process to use a Cisco WLC captive portal I've verified that only sql works.</div><div><br></div><div>If I add in users DEFAULT<span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type = ntlm_auth, then also AD users are authenticated, but not mysql ones.</div><div><br></div><div>radiusd -X reports in this case:</div><div><br></div><div>++[logintime] returns noop</div><div>[pap] WARNING: Auth-Type already set. Not setting to PAP</div><div>++[pap] returns noop</div><div>Found Auth-Type = ntlm_auth</div><div><br></div><div>Instead in absence of DEFAULT<span class="Apple-tab-span" style="white-space: pre; "> </span>Auth-Type = ntlm_auth in users, I logs :</div><div><br></div><div>====</div><div><div>rad_recv: Access-Request packet from host 150.178.3.53 port 55249, id=114, length=77</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "barbato"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "xxxxxxxxxxx"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 150.178.33.105</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x122864a655b86ac6d24c76e360fac328</div><div># Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>++[mschap] returns noop</div><div>++[unix] returns notfound</div><div>[suffix] No '@' in User-Name = "barbato", looking up realm NULL</div><div>[suffix] Found realm "NULL"</div><div>[suffix] Adding Stripped-User-Name = "barbato"</div><div>[suffix] Adding Realm = "NULL"</div><div>[suffix] Authentication realm is LOCAL.</div><div>++[suffix] returns ok</div><div>[ntdomain] Request already proxied. Ignoring.</div><div>++[ntdomain] returns ok</div><div>[eap] No EAP-Message, not doing EAP</div><div>++[eap] returns noop</div><div>++[files] returns noop</div><div>[sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> barbato</div><div>[sql] sql_set_user escaped user --> 'barbato'</div><div>rlm_sql (sql): Reserving sql socket id: 4</div><div>[sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'barbato' ORDER BY id</div><div>[sql] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'barbato' ORDER BY priority</div><div>rlm_sql (sql): Released sql socket id: 4</div><div>[sql] User barbato not found</div><div>++[sql] returns notfound</div><div>++? if (ok)</div><div>? Evaluating (ok) -> FALSE</div><div>++? if (ok) -> FALSE</div><div>++[expiration] returns noop</div><div>++[logintime] returns noop</div><div>[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.</div><div>++[pap] returns noop</div><div>ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user</div><div>Failed to authenticate the user.</div><div>Login incorrect: [barbato] (from client rfxnet1 port 1)</div><div>Using Post-Auth-Type Reject</div><div># Executing group from file /usr/local/etc/raddb/sites-enabled/default</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> barbato</div><div>attr_filter: Matched entry DEFAULT at line 11</div><div>++[attr_filter.access_reject] returns updated</div></div><div>===</div><div><br></div><div>radtest behave the same.</div><div><br></div><div>So it's seems I miss something somewhere….any suggestion from the list ?</div><div><br></div><div><br></div><div><br></div><div>Regards,</div><div>Paolo.</div><div><br></div><div><div apple-content-edited="true">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>------------------------------------------------------------------------------------------------</div></div><div>Paolo Barbato</div><div><br></div><div><a href="http://www.igi.cnr.it">Consorzio RFX</a></div><div><div>corso Stati Uniti,4 </div><div>35127 Padova - Italy <span class="Apple-tab-span" style="white-space: pre; "> </span> </div><div><div>Network Administrator </div><div>phone: +39 049 8295097 fax: +39 049 8700718</div></div><div>------------------------------------------------------------------------------------------------</div></div></div></div></div></div></span></div></div>
</div>
<br></div></body></html>