May 2007 - Freeradius-Users - lists.freeradius.org

Long Access time
by Josh Shamir 10 May '07

10 May '07

Hi all, I have implemented Freeradius with LDAP, all works without error but when the user log in the access time is too log (about 3,5 minutes). This access time isn't platform depended (we use Windows and Mac client). These are the log: proxy.conf proxy server { synchronous = yes retry_delay = 0 retry_count = 0 dead_time = 0 default_fallback = yes post_proxy_authorize = no } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm localhost { type = radius authhost = 192.168.181.1:1645 accthost = 192.168.181.1:1646 secret = PASSWORD nostrip } ------------------------ RADLAST user3 000:chilli 192.168.182.123 Tue May 8 10:57 - 11:09 (00:12) user3 000:chilli 192.168.182.123 Tue May 8 10:57 - 10:57 (00:00) user3 000:chilli 192.168.182.123 Tue May 8 10:56 - 10:57 (00:00) user3 000:chilli 192.168.182.123 Tue May 8 10:56 - 10:56 (00:00) luca.tar 000:chilli 192.168.182.120 Tue May 8 10:43 - 10:49 (00:05) luca.tar 000:chilli 192.168.182.120 Tue May 8 10:43 - 10:43 (00:00) user3 000:chilli 192.168.182.119 Tue May 8 10:36 - 10:40 (00:03) user3 000:chilli 192.168.182.119 Tue May 8 10:36 - 10:36 (00:00) user3 000:chilli 192.168.182.119 Tue May 8 10:35 - 10:36 (00:00) user3 000:chilli 192.168.182.119 Tue May 8 10:35 - 10:35 (00:00) luca.tar 000:chilli 192.168.182.117 Tue May 8 10:35 - 10:35 (00:00) luca.tar 000:chilli 192.168.182.117 Tue May 8 10:34 - 10:35 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:33 - 10:34 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:33 - 10:33 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:32 - 10:33 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:32 - 10:32 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:31 - 10:32 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:31 - 10:31 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:30 - 10:31 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:30 - 10:30 (00:00) luca.tar 000:chilli 192.168.182.116 Tue May 8 10:29 - 10:30 (00:00) luca.tar 000:chilli 192.168.182.113 Tue May 8 10:11 - 10:15 (00:03) luca.tar 000:chilli 192.168.182.113 Tue May 8 10:11 - 10:11 (00:00) luca.tar 000:chilli 192.168.182.113 Tue May 8 10:10 - 10:11 (00:00) luca.tar 000:chilli 192.168.182.109 Tue May 8 09:45 - 09:52 (00:07) luca.tar 000:chilli 192.168.182.109 Tue May 8 09:44 - 09:45 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:43 - 09:44 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:43 - 09:43 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:42 - 09:43 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:42 - 09:42 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:41 - 09:42 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:41 - 09:41 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:40 - 09:41 (00:00) luca.tar 000:chilli 192.168.182.108 Tue May 8 09:40 - 09:40 (00:00) user2 000:chilli 192.168.182.101 Tue May 8 08:42 - 09:40 (00:57) ---------------------------------------------- This is the client's log: Macintosh:~ luca$ tail -f /var/log/system.log system.log system.log.0.gz system.log.1.gz system.log.2.gz Macintosh:~ luca$ tail -f /var/log/system.log May 8 10:35:08 Macintosh lookupd[1969]: lookupd (version 369.6) starting - Tue May 8 10:35:08 2007 May 8 10:35:11 Macintosh kernel[0]: 11D beacon causing regdomain change to CC 826 May 8 10:35:11 Macintosh kernel[0]: en1: 802.11d country code set to 'GB'. May 8 10:35:11 Macintosh kernel[0]: en1: Supported channels 1 2 3 4 5 6 7 8 9 10 11 12 13 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 May 8 10:35:14 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:35:18 Macintosh mDNSResponder: Repeated transitions for interface en1 (FE80:0000:0000:0000:021B:63FF :FE00:0CDE); delaying packets by 5 seconds May 8 10:35:20 Macintosh configd[35]: posting notification com.apple.system.config.network_change May 8 10:35:20 Macintosh lookupd[1971]: lookupd (version 369.6) starting - Tue May 8 10:35:20 2007 May 8 10:35:22 Macintosh mDNSResponder: Repeated transitions for interface en1 ( 169.254.95.177); delaying packets by 5 seconds May 8 10:35:44 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:36:15 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:36:45 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:37:15 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:37:45 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:38:16 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:38:47 Macintosh eapolclient[243]: eapmschapv2_success_request: successfully authenticated May 8 10:38:53 Macintosh configd[35]: posting notification com.apple.system.config.network_change May 8 10:38:53 Macintosh lookupd[1983]: lookupd (version 369.6) starting - Tue May 8 10:38:53 2007 -------------------------------- Thanks! Josh

2 7

freeradius & redback sms
by Samson Martinez 10 May '07

10 May '07

We are currently using a Redback SMS 500 to terminate PPPoE sessions for client desktops. Up until now an older Steelbelted Radius server has been used to authenticate RADIUS requests forwarded by the Redback and it's worked ok. We want to transfer the RADIUS support to a freeradius installation but I am having a bit of a fit trying to get it to work. We are running freeradius version 1.0.1, I've added the dictionary.redback reference to the dictionary file, added the secret & shortname to the clients.conf file, and I get this on the redback when trying to authenticate: 09:10:40 9May2007: %RAD-7-SEND_IPADDR: Sent to 10.103.0.4: port 1812 09:10:40 9May2007: %RAD-7-SPKT: Sent packet: 0x01 00 00 4f 65 0f 55 dd 7c a2 0b 7d a4 bf a0 b3 85 37 a3 4e 01 0d 6a 61 6b 65 31 40 6c 6f 63 61 6c 03 13 01 c7 24 7a b9 3e 1f 8d ec bc ea 4d 35 84 10 2d cf 20 09 52 65 64 42 61 63 6b 06 06 00 00 00 02 07 06 00 00 00 01 05 06 07 00 00 01 09:10:40 9May2007: %RAD-7-RPKT: Received packet: 0x02 00 00 20 c8 c3 8a c4 dc d3 6a 6b 59 a4 25 57 ea 1a ba 06 06 06 00 00 00 02 07 06 00 00 00 01 09:10:41 9May2007: %RAD-7-RATTR_I: Received attr type 6, val 2, status 0. 09:10:41 9May2007: %RAD-7-RATTR_I: Received attr type 7, val 1, status 0. 09:10:41 9May2007: %RAD-7-RATTR_NO_CN: Global authentication configured, but no Context-Name provided. Speaking of which, what should my nastype in the clients.conf file be? I entered redback but I couldn't confirm if that was correct. Thanks! -Samson

3 3

Re: Pool-Name from Called-Station-Id
by Hugh Messenger 09 May '07

09 May '07

Alan DeKok <aland(a)deployingradius.com> says: > $ man users DOH!! Mea Maxima Culpa. I swear I read that through twice, and managed to blind-spot on the =~ both times. > Alan DeKok. -- hugh

1 0

Pool-Name from Called-Station-Id
by Hugh Messenger 09 May '07

09 May '07

Another classic Dumb Question. Over the next few months I'm going to be setting up a lot of IP pools for sqlippool. My Pool-Name's are based on the Called-Station-Id. The way I'm doing it right now is a DEFAULT for each one, like this: DEFAULT Called-Station-Id == brantley_pppoe_141, Pool-Name := "brantley_pppoe_141" Fall-Through = 1 DEFAULT Called-Station-Id == elba_pppoe_142, Pool-Name := "elba_pppoe_142" Fall-Through = 1 [etc] Is there some way I can make this generic, so I don't have to add each one to the users file seperately? Conceptually, it'd be like ... DEFAULT Called-Station-Id == /^(\w+_pppoe_\d+)$/, Pool-Name := "$1" -- hugh

2 1

return code of "session" section ignored?
by Milan Holub 09 May '07

09 May '07

Hi Alan, probably another bug report: in my radiusd.conf: ... session { reject } ... and when authenticating some user: 2007-05-03 12:57:50.210429500 modcall[authenticate]: module "perl" returns ok for request 4 2007-05-03 12:57:50.210432500 modcall: group PERL returns ok for request 4 2007-05-03 12:57:50.210434500 Processing the session section of radiusd.conf 2007-05-03 12:57:50.210436500 modcall: entering group session for request 4 2007-05-03 12:57:50.210451500 modcall[session]: module "reject" returns reject for request 4 2007-05-03 12:57:50.210453500 modcall: group session returns reject for request 4 2007-05-03 12:57:50.210456500 Login OK: [skzxtz/xtbsjs] (from client localhost port 5281) 2007-05-03 12:57:50.210458500 Processing the post-auth section of radiusd.conf 2007-05-03 12:57:50.210460500 modcall: entering group post-auth for request 4 As you can see "group session" returned REJECT but the user is accepted! Is it a bug or a feature? Or am I missing something? I've discovered this when having: ... session { sql { fail = reject } } ... I'm using checkrad to query NAS about the user. By above I wanted to assure that when the checkrad fails(eg. because of firewall) then by default we assume that the user is logged in... Please advise. PS: Observed on cvs head from Apr 30 but I've checked changes since then and I do not think this was fixed. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

Wrong Realm in the detail files
by Rio Yang 09 May '07

09 May '07

Hi, Recently, I found the wrong realm in the detail files. This log is captured from detail file. Tue May 8 17:46:41 2007 Class = 0x417074696c6f313a313a31383030 User-Name = "ABC/950160(a)def.org" Acct-Status-Type = Start Acct-Session-Id = "464046fecc9c08a5" Acct-Delay-Time = 0 Acct-Authentic = RADIUS Framed-IP-Address = <Encrypted> NAS-IP-Address = <Encrypted> NAS-Port-Type = Wireless-802.11 Event-Timestamp = "May 8 2007 17:46:41 CST" NAS-Identifier = "NAS" Vendor-13209-Attr-9 = 0x5157464e484150433037 Called-Station-Id = <Encrypted> Calling-Station-Id = <Encrypted> Vendor-13209-Attr-1 = 0x5177617265507562537461726275636b73 NAS-Port-Id = "NAS-Port" WISPr-Location-ID = <Encrypted> WISPr-Location-Name = <Encrypted> Proxy-State = 0x30 Client-IP-Address = <Encrypted> Acct-Unique-Session-Id = "26719654223287c6" Stripped-User-Name = "ABC/950160" Realm = "def.org" Freeradius-Proxied-To = <Encrypted> Timestamp = 1178617601 I configured two realm in proxy.conf. One is realm "ABC" (prefix mode), and another is "def.org" (suffix mode). In my thinking, when request come into radius, prefix will work first then suffix. (configured in radius.conf) In this case, I should have a realm value "ABC" and Stripped-User-Name value "950160(a)def.org". But I got the realm value "def.org" and Stripped-User-Name value "ABC/950160". Is it a bug ? or some configuration I missed. PS. I'm using freeradius-1.1.2. Thanks. Rio

2 2

Access-Accept Packet and Attribute 29
by nicolaskarp＠free.fr 09 May '07

09 May '07

Hello Everybody, I must use the attribute : "29 : Termination-Action" with an access-accept packet. How could I do this ? My Huawei device uses this attribute to allow a user to manage the switch with a specific level. Thank you for your assistance ! Best regards, Nicolas.

2 1

How to use `checkItem' in file `ldap.attrmap'
by wj 09 May '07

09 May '07

What's the meaning of `checkItem'? How to use it?

2 1

Re: eap-tls authentication with free radius 1.1.5
by anoop_c＠sifycorp.com 09 May '07

09 May '07

Quoting freeradius-users-request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body \'help\' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than \"Re: Contents of Freeradius-Users digest...\" > > > Today\'s Topics: Hi Alan I stil havn\'t get the exact problem.Earlier i was using freeradius-snapshot-20021028 .For eap-tls i made changes in radiusd.conf,clients.conf and users file. With 1.1.5 version i didn;t change radiusd.conf. Pls tell me what are the configuration required in the radiusd.conf,eap.conf,clients.conf and users file. Anoop > > 1. Re: FreeRadius crash (Alan DeKok) > 2. Re: IP billing with freeradius (tnt(a)kalik.co.yu) > 3. Re: IP billing with freeradius (Alexander V. Klepikov) > 4. Re: eap-tls authentication with free radius 1.1.5 (Alan > DeKok) (anoop_c(a)sifycorp.com) > 5. Re: eap-tls authentication with free radius 1.1.5 (Alan > DeKok) (anoop_c(a)sifycorp.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 08 May 2007 09:49:56 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: FreeRadius crash > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <46402BA4.7090805(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Doug Hardie wrote: > > FreeRadius 1.1.2 on FreeBSD 6.1 using libpthread. > > Upgrade to 1.1.6. It has a lot of fixes that may help. > > It looks like it\'s crashing when starting a new child thread. That > may be a pthread issue in the underlying libraries. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 2 > Date: Tue, 08 May 2007 09:38:19 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: IP billing with freeradius > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <CLwKM75d.1178613499.9866420.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > This is nothing to do with radius. Use netflow. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 8/5/2007, \"satish patel\" <linuxtrap(a)yahoo.co.in> pi?e: > > >thnks for reply dear > > > > But my requiremnt is a bit different means i explain u in > depth i have datacenter in data center many customers and we are giving > ip pool to our customer and terminate that pool on 6500 cisco core > switch so i want bandwidth counter on that port wheather all customer > server connected so that i can billing of that perticuler port means how > much upload and how much download traffic of that port then i can > genrate bill of that port it is not possible i can genrate traffic uage > of verey servers so that i want to genrate traffic counter of that > single cisco switch port you got it my point it is possibel through mrtg > but i want counter values so it is possible with freeradius > > > >tnt(a)kalik.co.yu wrote: If you are using sql accounting then make a > sqlcounter that counts octets > >and send Auth-Type Reject if counter is over 10GB. > > > >Ivan Kalik > >Kalik Informatika ISP > > > >Dana 7/5/2007, \"satish patel\" > > pi?e: > > > >>Dear Sir > >> > >> I am working in data center so i need ip base > billing means which ip address useing how much bandwidth means i give 10 > GB data transfer to my one customer and 10GB data transfer reached then > i got mesge or i can block the port of server what ever this is example > so it is possible can i accouting of data transfer through my core > switch ?? > >> > >> > >>Reghards > >> > >>Satish Patel > >> > >> > >>$ cat ~/satish/url.txt > >> > >>System administrator ( Data Center ) > >> > >>please visit this site > >> > >>http://linux.tulipit.com > >> > >>--------------------------------- > >> Office firewalls, cyber cafes, college labs, don\'t allow you to > download CHAT? Here\'s a solution! > >> > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > >$ cat ~/satish/url.txt > > > >System administrator ( Data Center ) > > > >please visit this site > > > >http://linux.tulipit.com > > > >--------------------------------- > > Office firewalls, cyber cafes, college labs, don\'t allow you to > download CHAT? Here\'s a solution! > > > > > > ------------------------------ > > Message: 3 > Date: Tue, 8 May 2007 11:55:01 +0300 > From: \"Alexander V. Klepikov\" <klepikov_a(a)up.ua> > Subject: Re: IP billing with freeradius > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <00db01c7914e$908413c0$0301010a@klepikova> > Content-Type: text/plain; format=flowed; charset=\"iso-8859-2\"; > reply-type=original > > Hello, tnt(a)kalik.co.yu! > You wrote on Tue, 08 May 2007 09:38:19 +0100: > > t> This is nothing to do with radius. Use netflow. > > What about dot1x auth + accounting? Though it may be not so good for > servers. > > With best regards, Alexander V. Klepikov. E-mail: klepikov_a(a)up.ua > > > > ------------------------------ > > Message: 4 > Date: Tue, 08 May 2007 15:27:49 +0600 (IST) > From: anoop_c(a)sifycorp.com > Subject: Re: eap-tls authentication with free radius 1.1.5 (Alan > DeKok) > To: freeradius-users(a)lists.freeradius.org, > freeradius-users-request(a)lists.freeradius.org > Cc: freeradius-users(a)lists.freeradius.org > Message-ID: <1178618269.4640499db1808(a)mail.sifycorp.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi > i didn\'t get the exact problem. I have gone through eap.conf. > Pls make little bit clear abt the problem > > Anoop > > freeradius-users-request(a)lists.freeradius.org: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body \'help\' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than \"Re: Contents of Freeradius-Users digest...\" > > > > > > Today\'s Topics: > > > > 1. Re: MySQL and postauth_query (George Embrey) > > 2. Re: FreeRadius crash (A.L.M.Buxey(a)lboro.ac.uk) > > 3. Re: MySQL and postauth_query (Peter Nixon) > > 4. Re: rlm_sqlippool in freeradius 1.1.6 (Peter Nixon) > > 5. Re: IP billing with freeradius (satish patel) > > 6. Re: IP billing with freeradius (Peter Nixon) > > 7. Re: eap-tls authentication with free radius 1.1.5 (Alan DeKok) > > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 08 May 2007 14:38:39 +1000 > > From: George Embrey <george(a)vmail.net.au> > > Subject: Re: MySQL and postauth_query > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <463FFECF.7080101(a)vmail.net.au> > > Content-Type: text/plain; charset=\"us-ascii\" > > > > Hugh Messenger wrote: > > > > >George Embrey <george(a)vmail.net.au> says: > > > > > > > > >>Queries to Windows MySQL servers from Linux Systems often fail > unless > > >>the lower_case_table_names parameter is set to 0 in the my.ini file > > in > > >>the MySQL directory. > > >> > > >> > > > > > >I\'m familiar with that issue, and I checked all the table case-ness. > > > The > > >problem seems to be with providing an empty string (\'\') as the > value > > for an > > >auto-incrementing integer primary index. > > > > > > > > Yes that is true \'\' or empty strings are not nulls or integers... I > > suggest replacing the \'\' with the word null, this will sort out the > > issue based on the query you specified. > > > > >The problem with setting lower_case_table_names to 0 is that I could > > end up > > >blowing away my MyISAM tables elsewhere in that server, as per the > > warning > > >the service control gives, if I moof a query on those and use the > > \"wrong\" > > >case: > > > > > > > > > > > I would rename the MyISAM tables using phpmyadmin or using SQL and > sort > > out the Database to run case sensitive in the first place like the > ANSI > > standard. > > > > Or much better still mysqldump the entire MySQL server into a file > > \"textfilename.sql\", sort out the table names etc... using a good > text > > editor, place a drop table if exists before each create table entry, > > save the file then run mysql -uroot -p < \"textfilename.sql\" to > recreate > > all of the databases including data with tablenames in the correct > > case... > > > > Maybe I am just too fussy... > > > > >\"You have forced lower_case_table_names to 0 through a command-line > > option, > > >even though your file system \'E:MySQLData\' is case insensitive. > > This > > >means that you can corrupt a MyISAM table by accessing it with > > different > > >cases. You should consider changing lower_case_table_names to 1 or > 2\" > > > > > > > > > > > Only if you live in an all windows world... \"Compatability is a > bitch > > it > > demands the use of standards, the little things which M$ don\'t > adhere > > to > > very well\" ;-) > > > > >It\'s working fine with my modifie query, so I\'m just going to put > this > > down > > >to \"a 5.x thing\" and live with my change. Compared to the > wholesale > > hack > > >and slash job I\'ve had to do on the sqlippool queries to get them > to > > work, > > >it\'s no Big Whoop, LOL! > > > > > >But thanks for the suggestion, I appreciate your time. > > > > > > -- hugh > > > > > >- > > >List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > > > > George Embrey > > CEO / Senior Systems Architect. > > Vmail Internet Services Pty Ltd. > > 318 Shoal Point Road > > Shoal Point QLD 4750 > > Australia > >

2 1

Re: Machine-Authentication against SaMBa account in LDAP Directory
by Christian Hohmann 09 May '07

09 May '07

Hi members, @Joe: I use Version 3.0.22-13 of Samba. But I think the "username" that windows sends for Authentication with host account is controlled by the windows client. There I use a Win XP with SP2. @Phil: Thanks, this solution works great. So I can eliminate the second Request to the radius-Service caused by the Local-realm of the ntdomain "host/". @Jacob: It seems to be a good work around, but it would increase the calls to LDAP directory, so i decided to use Phils suggestion. I solved the problem using the mschap module in the filter line of the LDAP paragraph that Phil suggested. Thanks a lot for your hints, simply great! Best regards - Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0