<div dir="ltr"><div><div><div><div><div><div>I've set up the LDAP bind how I think it should be done and it seems to be binding correctly. It, however, is not successfully authenticating a user. This is the radiusd -X output:<br>
<br><span style="font-family:courier new,monospace">Ready to process requests.<br>rad_recv: Access-Request packet from host 10.10.20.40 port 1645, id=15,<br>length=95<br></span></div><span style="font-family:courier new,monospace"> NAS-IP-Address = 10.10.20.40<br>
</span></div><span style="font-family:courier new,monospace"> NAS-Port = 2<br></span></div><span style="font-family:courier new,monospace"> NAS-Port-Type = Virtual<br></span></div><span style="font-family:courier new,monospace"> User-Name = 'user'<br>
</span></div><span style="font-family:courier new,monospace"> Calling-Station-Id = '10.10.1.35'<br></span></div><span style="font-family:courier new,monospace"> User-Password = 'password'<br>
</span><div><div><div><div><div><div><span style="font-family:courier new,monospace">(1) # Executing section authorize from file /usr/local/etc/raddb/sites-<br></span></div><div><span style="font-family:courier new,monospace">enabled/default<br>
</span></div><div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) authorize {</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) filter_username filter_username {</span></div>
<span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name != "%{tolower:%{User-Name}}")</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) expand: "%{tolower:%{User-Name}}" -> 'user'</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE</span></div><span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ / /)</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ / /) -> FALSE</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /@.*@/ )</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">
(1) ? if (User-Name =~ /@.*@/ ) -> FALSE</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /\\.\\./ )</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /\\.\\./ ) -> FALSE</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/))</span></div><span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /\\.$/)</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /\\.$/) -> FALSE</span></div><span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /@\\./)</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (User-Name =~ /@\\./) -> FALSE</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) } # filter_username filter_username = notfound</span></div><span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [preprocess] = ok<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">rlm_ldap (ldap): Reserved connection (4)<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : expand: "(uid:%{%{Stripped-User-Name} :- %{User-Name}})" -><br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">'(uid=user)'<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1)</span><font face="courier new,monospace"> ldap :</font> <span style="font-family:courier new,monospace">expand: "ou=DOMAIN Users,dc=DOMAIN,dc=com" -> 'ou=DOMAIN<br>
Users,DC=DOMAIN,DC=com'<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : Performing search in 'ou=DOMAIN Users,dc=DOMAIN,dc=com' with<br></span></div><div class="gmail_extra">
<span style="font-family:courier new,monospace">filter '(uid=user)'<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : Waiting for search result...<br></span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : User object found at DN "CN=Joe Bloggs,OU=GROUP,OU=DOMAIN<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">Users,DC=DOMAIN,DC=com"<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">rlm_ldap (ldap): Released connection (4)<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">rlm_ldap (ldap): Opening additional connection (5)<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">rlm_ldap (ldap): Connection to <a href="http://domaincontroller.DOMAIN.com:389" target="_blank">domaincontroller.DOMAIN.com:389</a><br>
</span></div><div class="gmail_extra">
<span style="font-family:courier new,monospace">rlm_ldap (ldap): Waiting for bind result...<br>rlm_ldap (ldap): Bind successful<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [ldap] = ok<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [chap] = noop<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [mschap] = noop<br>
</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [digest] = noop<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) suffix : No '@' in User-Name = "user", looking up realm NULL<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) suffix : No such realm "NULL"<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [suffix] = noop<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) eap : No EAP-Message, not doing EAP<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [eap] = noop<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [files] = noop<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">rlm_ldap (ldap): Reserved connection (5)<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : expand: "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" -><br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">'(uid=user)'<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : expand: </span><span style="font-family:courier new,monospace">"ou=DOMAIN Users,dc=DOMAIN,dc=com" -> 'ou=DOMAIN<br>
Users,DC=DOMAIN,DC=com'<br></span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : Performing search in 'ou=DOMAIN Users,dc=DOMAIN,dc=com' with<br></span></div><span style="font-family:courier new,monospace">filter '(uid=user)'</span><br>
<span style="font-family:courier new,monospace">(1) ldap : Waiting for search result...</span><br></div><div class="gmail_extra"><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ldap : User object found at DN "CN=Joe Bloggs,OU=GROUP,OU=DOMAIN<br>
</span></div><span style="font-family:courier new,monospace">Users,DC=DOMAIN,DC=com"<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">rlm_ldap (ldap): Released connection (5)<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [ldap] = ok<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [expiration] = noop<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [logintime] = noop<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) WARNING: pap : No "known good" password found for the user. Not setting<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">Auth-Type.<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) WARNING: pap : Authentication will fail unless a "known good" password is<br>
available.<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [pap] = noop<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) } # authorize = ok<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) Failed the authenticate the user.<br>
</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) Using Post-Auth-Type Reject<br></span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) # Executing group from file /usr/local/etc/raddb/sites-</span><span style="font-family:courier new,monospace">enabled/default</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">
(1) Post-Auth-Type REJECT {</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) attr_filter.access_reject :<span style="white-space:pre-wrap"> </span>expand: "%{User-Name}" -> 'user'</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">
(1) attr_filter.access_reject : Matched entry DEFAULT at line 11</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [attr_filter.access_reject] = updated</span></div><div class="gmail_extra">
<span style="font-family:courier new,monospace">(1) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure</span></div><span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [eap] = noop</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) remove_reply_message_if_eap remove_reply_message_if_eap {</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (reply:EAP-Message && reply:Reply-Message)</span></div><span style="font-family:courier new,monospace">
</span><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) else else {</span></div>
<div class="gmail_extra"><span style="font-family:courier new,monospace">(1) [noop] = noop</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">
(1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) } # Post-Auth-Type REJECT = updated</span></div><div class="gmail_extra">
<span style="font-family:courier new,monospace">(1) Finished request 1.</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">
Waking up in 0.3 seconds.</span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">Waking up in 0.6 seconds.</span></div></div><div class="gmail_extra"><span style="font-family:courier new,monospace">(1) Sending delayed reject<br>
Sending Access-Reject of id 15 from 10.10.20.26 port 1812 to 10.10.20.40 port<br>1645<br></span></div><div class="gmail_extra"><span style="font-family:courier new,monospace">Waking up in 4.9 seconds.</span><br></div><br>
</div></div></div></div></div></div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Thanks<br></div><div class="gmail_extra">-Luke<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jan 28, 2014 at 11:57 AM, Arran Cudbard-Bell <span dir="ltr"><<a href="mailto:a.cudbardb@freeradius.org" target="_blank">a.cudbardb@freeradius.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><br>
On 28 Jan 2014, at 11:35, Luke Ramsden <<a href="mailto:lukermsdn@gmail.com" target="_blank">lukermsdn@gmail.com</a>> wrote:<br>
<br>
> I have experimented with using LDAP bind before and encountered problems (see link below). One of the responses on the thread said I must use MSCHAPv2 if I do not have plaintext passwords in AD - which I do not:<br>
><br>
> "Unless you are storing passwords in Active Directory in plain text or you want to use Kerberos authentication, you will have to use MSCHAPv2 (or its EAP equivalent, EAP-MSCHAPv2)."<br>
><br>
> Previous thread relating to LDAP auth: <a href="http://freeradius.1045715.n5.nabble.com/LDAP-Active-Directory-Authentication-Issue-td5724001.html#a5724014" target="_blank">http://freeradius.1045715.n5.nabble.com/LDAP-Active-Directory-Authentication-Issue-td5724001.html#a5724014</a><br>
<br>
</div><div>Stefan's answer was slightly misleading.<br>
<br>
If you have the Cleartext-Password from the user you can attempt to bind as the user again the AD LDAP interface and use the bind result to determine whether to reject or allow the user.<br>
<br>
</div>Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org" target="_blank">a.cudbardb@freeradius.org</a>><br>
<div><div>FreeRADIUS Development Team<br>
<br>
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br>
<br>
</div></div><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div></div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On Tue, Jan 28, 2014 at 11:57 AM, Arran Cudbard-Bell <span dir="ltr"><<a href="mailto:a.cudbardb@freeradius.org" target="_blank">a.cudbardb@freeradius.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 28 Jan 2014, at 11:35, Luke Ramsden <<a href="mailto:lukermsdn@gmail.com">lukermsdn@gmail.com</a>> wrote:<br>
<br>
> I have experimented with using LDAP bind before and encountered problems (see link below). One of the responses on the thread said I must use MSCHAPv2 if I do not have plaintext passwords in AD - which I do not:<br>
><br>
> "Unless you are storing passwords in Active Directory in plain text or you want to use Kerberos authentication, you will have to use MSCHAPv2 (or its EAP equivalent, EAP-MSCHAPv2)."<br>
><br>
> Previous thread relating to LDAP auth: <a href="http://freeradius.1045715.n5.nabble.com/LDAP-Active-Directory-Authentication-Issue-td5724001.html#a5724014" target="_blank">http://freeradius.1045715.n5.nabble.com/LDAP-Active-Directory-Authentication-Issue-td5724001.html#a5724014</a><br>
<br>
</div><div class="im">Stefan's answer was slightly misleading.<br>
<br>
If you have the Cleartext-Password from the user you can attempt to bind as the user again the AD LDAP interface and use the bind result to determine whether to reject or allow the user.<br>
<br>
</div>Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>><br>
<div class="HOEnZb"><div class="h5">FreeRADIUS Development Team<br>
<br>
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br>
<br>
</div></div><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div>