April 2006 - Freeradius-Users - lists.freeradius.org

RE: Problem with LDAP against Active Directory
by Caines, Max 17 Apr '06

17 Apr '06

Hi Dominique There appears to be something wrong with the search base definition for your LDAP search. It looks like you are using the "traditional" LDAP basename which goes "ou=mydepartment, o=mycompany, c=ch". Active Directory uses basenames that look like "dc=ad, dc=ch". Your LDAP server is returning "operations error", so I should look in its log file for more details. By the way, bear in mind that unless you use Microsoft IAS, you can only do RADIUS authentication against AD using PAP (i.e. users send passwords in cleartext), which isn't too secure. Max Caines > -----Original Message----- > From: > freeradius-users-bounces+max.caines=wlv.ac.uk(a)lists.freeradius.org > [mailto:freeradius-users-bounces+max.caines=wlv.ac.uk@lists.fr > eeradius.o > rg]On Behalf Of domjullier(a)rhone.ch > Sent: 03 April 2006 10:27 > To: freeradius-users(a)lists.freeradius.org > Subject: Problem with LDAP against Active Directory > > > Hi folks, > I want authenticate users from a WLAN with freeradius. The > Users are stored in the Active Directory of a Windows 2003 > Server. > > With some Tutorials from the Internet I have configured > freeradius to make that. > > Unfortunately the Authentication function not succesfully. > > Thats the output from FreeRadius during the Authentication: > > rad_recv: Access-Request packet from host > 192.168.210.15:4596, id=13, length=100 > NAS-Port-Type = Ethernet > Service-Type = Login-User > User-Name = "ldap" > User-Password = "ldap" > Called-Station-Id = "00:01:02:ad:64:f7" > Calling-Station-Id = "00:c0:49:54:b5:43" > NAS-Port = 1 > Mon Apr 3 11:12:08 2006 : Debug: Processing the > authorize section of radiusd.conf > Mon Apr 3 11:12:08 2006 : Debug: modcall: entering group > authorize for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling preprocess (rlm_preprocess) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > returned from preprocess (rlm_preprocess) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: > module "preprocess" returns ok for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling chap (rlm_chap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > returned from chap (rlm_chap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: > module "chap" returns noop for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling mschap (rlm_mschap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > returned from mschap (rlm_mschap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: > module "mschap" returns noop for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling suffix (rlm_realm) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No '@' in > User-Name = "ldap", looking up realm NULL > Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No such > realm "NULL" > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > returned from suffix (rlm_realm) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: > module "suffix" returns noop for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling eap (rlm_eap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: rlm_eap: No > EAP-Message, not doing EAP > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > returned from eap (rlm_eap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: > module "eap" returns noop for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling files (rlm_files) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > returned from files (rlm_files) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: > module "files" returns notfound for request 2 > Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: > calling ldap (rlm_ldap) for request 2 > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: - authorize > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: performing user > authorization for ldap > Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: > '(uid=ldap)' > Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: 'ou=Sion, > o=ad.ch' > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: > Checking Id: 0 > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: > Got Id: 0 > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: attempting LDAP > reconnection > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: closing > existing LDAP connection > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: (re)connect to > ad.ch:389, authentication 0 > Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: bind as / to > ad.ch:389 > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: waiting for > bind result ... > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: Bind was > successful > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing > search in ou=Sion, o=ad.ch, with filter (uid=ldap) > Mon Apr 3 11:12:18 2006 : Error: rlm_ldap: ldap_search() > failed: Operations error > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: search failed > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: > ldap_release_conn: Release Id: 0 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from ldap (rlm_ldap) for request 2 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "ldap" returns fail for request 2 > Mon Apr 3 11:12:18 2006 : Debug: modcall: group authorize > returns fail for request 2 > Mon Apr 3 11:12:18 2006 : Debug: Finished request 2 > Mon Apr 3 11:12:18 2006 : Debug: Going to the next request > Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire > request list --- > Mon Apr 3 11:12:18 2006 : Debug: Waking up in 6 seconds... > rad_recv: Access-Request packet from host > 192.168.210.15:4596, id=13, length=100 > Mon Apr 3 11:12:18 2006 : Debug: Discarding duplicate > request from client testnet:4596 - ID: 13 > Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire > request list --- > Mon Apr 3 11:12:18 2006 : Debug: Cleaning up request 2 ID > 13 with timestamp 4430e6e8 > Mon Apr 3 11:12:18 2006 : Debug: Nothing to do. Sleeping > until we see a request. > rad_recv: Access-Request packet from host > 192.168.210.15:4596, id=13, length=100 > NAS-Port-Type = Ethernet > Service-Type = Login-User > User-Name = "ldap" > User-Password = "ldap" > Called-Station-Id = "00:01:02:ad:64:f7" > Calling-Station-Id = "00:c0:49:54:b5:43" > NAS-Port = 1 > Mon Apr 3 11:12:18 2006 : Debug: Processing the > authorize section of radiusd.conf > Mon Apr 3 11:12:18 2006 : Debug: modcall: entering group > authorize for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling preprocess (rlm_preprocess) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from preprocess (rlm_preprocess) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "preprocess" returns ok for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling chap (rlm_chap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from chap (rlm_chap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "chap" returns noop for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling mschap (rlm_mschap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from mschap (rlm_mschap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "mschap" returns noop for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling suffix (rlm_realm) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No '@' in > User-Name = "ldap", looking up realm NULL > Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No such > realm "NULL" > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from suffix (rlm_realm) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "suffix" returns noop for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling eap (rlm_eap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: rlm_eap: No > EAP-Message, not doing EAP > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from eap (rlm_eap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "eap" returns noop for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling files (rlm_files) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > returned from files (rlm_files) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: > module "files" returns notfound for request 3 > Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: > calling ldap (rlm_ldap) for request 3 > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: - authorize > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing user > authorization for ldap > Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: > '(uid=ldap)' > Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: 'ou=Sion, > o=ad.ch' > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: > Checking Id: 0 > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: > Got Id: 0 > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: attempting LDAP > reconnection > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: closing > existing LDAP connection > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: (re)connect to > ad.ch:389, authentication 0 > Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: bind as / to > ad.ch:389 > Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: waiting for > bind result ... > Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: Bind was > successful > Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: performing > search in ou=Sion, o=ad.ch, with filter (uid=ldap) > Mon Apr 3 11:12:28 2006 : Error: rlm_ldap: ldap_search() > failed: Operations error > Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: search failed > Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: > ldap_release_conn: Release Id: 0 > Mon Apr 3 11:12:28 2006 : Debug: modsingle[authorize]: > returned from ldap (rlm_ldap) for request 3 > Mon Apr 3 11:12:28 2006 : Debug: modcall[authorize]: > module "ldap" returns fail for request 3 > Mon Apr 3 11:12:28 2006 : Debug: modcall: group authorize > returns fail for request 3 > Mon Apr 3 11:12:28 2006 : Debug: Finished request 3 > Mon Apr 3 11:12:28 2006 : Debug: Going to the next request > Mon Apr 3 11:12:28 2006 : Debug: --- Walking the entire > request list --- > Mon Apr 3 11:12:28 2006 : Debug: Waking up in 6 seconds... > Mon Apr 3 11:12:34 2006 : Debug: --- Walking the entire > request list --- > Mon Apr 3 11:12:34 2006 : Debug: Cleaning up request 3 ID > 13 with timestamp 4430e6f2 > Mon Apr 3 11:12:34 2006 : Debug: Nothing to do. Sleeping > until we see a request. > > Where can I fix the misstake which produce this error? > > greets > > dominique > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

6 10

Re:Send information to the Radius Client
by foreveruni＠clix.pt 17 Apr '06

17 Apr '06

why don't you use ldap for that?for the info. On Monday 17 April 2006 11:07, freeradius-users-request(a)lists.freeradius.org wrote: > Message: 2 > Date: Mon, 17 Apr 2006 04:46:28 +0200 > From: Carlos Pe?afiel <carpeher(a)hotmail.com> > Subject: Send information to the Radius Client > To: freeradius-users(a)lists.freeradius.org > Message-ID: <BAY105-F28D6D76241DE735F8F067DD5C70(a)phx.gbl> > Content-Type: text/plain; charset=iso-8859-1; format=flowed > > Hello, > > I want to be able to send information (such a name, address, phone > number ...) from the Radius Server to the Radius Client( I want to do that > to a Host AP) after the Radius client has been authenticated. I am not sure > if I have to create a module (I do not know if it is necessary). But I do > not know what files I must change. Can you help me? can you give an idea? > > I am using freeradius-1.1.1 and the client is Hostap-0.4.8. > > Thank you a lot in advance.

1 0