<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:΢ÈíÑźÚ
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><br>I have no right to change the setting of ldap server, and it will not reply me with a psssword. It only give me the accept message.<br><div><hr id="stopSpelling">From: midnightsteel@msn.com<br>To: freeradius-users@lists.freeradius.org<br>Subject: RE: Radius Server and Ldap Server<br>Date: Mon, 13 Jan 2014 05:31:45 -0500<br><br><style><!--
.ExternalClass p.ecxMsoNormal, .ExternalClass li.ecxMsoNormal, .ExternalClass div.ecxMsoNormal {
font-size:12.0pt;
font-family:SimSun;
}
.ExternalClass a:link, .ExternalClass span.ecxMsoHyperlink {
color:#0563C1;
text-decoration:underline;
}
.ExternalClass span.ecxMsoHyperlinkFollowed {
color:#954F72;
text-decoration:underline;
}
.ExternalClass p {
font-size:12.0pt;
font-family:SimSun;
}
.ExternalClass pre {
font-size:12.0pt;
font-family:SimSun;
}
.ExternalClass span.ecxHTMLPreformattedChar {
font-family:"Consolas","serif";
}
.ExternalClass span.ecxEmailStyle20 {
font-family:"Calibri","sans-serif";
color:#1F497D;
}
.ExternalClass .ecxMsoChpDefault {
font-size:10.0pt;
}
.ExternalClass div.ecxWordSection1 {
}
--></style><div class="ecxWordSection1"><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;">I go this to work by changing the format that ldap stores the password. I changed it to clear text. Its not ideal but it works for me</span></p><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;"> </span></p><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;"> </span></p><div><div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in;"><p class="ecxMsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";"> freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] <b>On Behalf Of </b>???<br><b>Sent:</b> Monday, January 13, 2014 5:24 AM<br><b>To:</b> FreeRadius users mailing list<br><b>Subject:</b> RE: Radius Server and Ldap Server</span></p></div></div><p class="ecxMsoNormal"> </p><div><p class="ecxMsoNormal" style=""><span style="font-family:"Microsoft YaHei","sans-serif";">Hi, Thanks for your help. After apply the configuration you recommend to the inner-tunnel file, the debug information no process for searching ldap server, and user from ldap database still can not be authenticated.<br>There are also infomation about<br><br>/***********************************************************************/<br>[eap] Request found, released from the list<br>[eap] EAP/mschapv2<br>[eap] processing type mschapv2<br>[mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel<br>[mschapv2] +group MS-CHAP {<br>[mschap] No Cleartext-Password configured. Cannot create LM-Password.<br>[mschap] No Cleartext-Password configured. Cannot create NT-Password.<br>[mschap] Creating challenge hash with username: liy1<br>[mschap] Client is using MS-CHAPv2 for liy1, we need NT-Password<br>[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.<br>[mschap] FAILED: MS-CHAP2-Response is incorrect<br>++[mschap] = reject<br>+} # group MS-CHAP = reject<br>[eap] Freeing handler<br>++[eap] = reject<br>+} # group authenticate = reject<br>Failed to authenticate the user.<br>/***********************************************************************/<br><br>I have changed the ldap.attrmap to: <br>checkitem Cleartext-Password userpassword<br><br>Thanks, waiting for your reply.<br><br></span></p><div><p class="ecxMsoNormal" style=""><span style="font-family:"Microsoft YaHei","sans-serif";">Subject: Re: Radius Server and Ldap Server<br>From: <a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a><br>Date: Mon, 13 Jan 2014 09:50:39 +0000<br>To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a></span></p><pre> <br>On 13 Jan 2014, at 09:15, <span lang="ZH-CN">ÀîÑÇÀ¤</span> <<a href="mailto:liyakun127@hotmail.com">liyakun127@hotmail.com</a>> wrote:<br> <br>> Hello all,<br>> <br>> I am trying to set up a radius server to perform authentication for wifi<br>> login against the user with password database in LDAP.<br>> <br>> I have no right to get the password back from LDAP, and the only reply<br>> information from LDAP server is the I login in success.<br>> <br>> However, I need to login wifi by a user name and password stored in LDAP<br>> server, without the reply password from LDAP, how can the radius server<br>> check whether the password I have provided is correct.<br> <br>By attempting to bind as the user.<br> <br>authorize {<br> if (User-Password) {<br> update control {<br> Auth-Type := LDAP<br> }<br> }<br>}<br> <br>authenticate {<br> Auth-Type LDAP {<br> ldap<br> }<br>}<br> <br>-Arran<br> <br>Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>><br>FreeRADIUS Development Team<br> <br>FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br> </pre><p class="ecxMsoNormal"><span style="font-family:"Microsoft YaHei","sans-serif";"><br>- List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></span></p></div></div></div><br>-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html</div> </div></body>
</html>