I think I may have found a bug in rlm_perl? I have written script with
the aid of another freeradius list member that checks to see if a user
is in a certain samba windows group. If they are not in the group (the
wireless group) the module rejects the login. The module works perfectly
except for those users who's usernames begin with a letter t. For
instance ISD\josh will succeed but ISD\\ted will fail. I have done much
testing and cant find my script to be the issue. Look below for debug
output for the perl module.
Notice that right after the ++[files] line I print out the radius items
for debugging. Notice the User-Name value is correct going into the perl
script. Notice on the exit of the perl script on each debug that the
username is correct. Then notice later in each debug where these lines are:
Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel)
but when the username begins with a "t" it fails here like this:
Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via
TLS tunnel)
Notice only one backslash.
I have tried to make it succeed by adding backslashes (for users that
start with t) but no success. It will do ISD\\\tbraun and ISD\tbraun but
never ISD\\tbraun. Therefore, with users that start with "t" I always
get User-name does not match eap identity failure.
Thanks for any help. At the very bottom after the debug output you will
find my simple perl script that is well commented.
-Josh
------- Successful attempt --------
++[files] returns noop
They key is User-Name and the value is ISD\\josh.They key is EAP-Message
and the value is 0x020900061a03.They key is EAP-Type and the value is
MS-CHAP-V2.They key is State and the value is
0xfeecb38bffe5a965a0ca1cd92ce6c42b.They key is FreeRADIUS-Proxied-To and
the value is 127.0.0.1.
rlm_perl: Added pair User-Name = ISD\josh
rlm_perl: Added pair EAP-Message = 0x020900061a03
rlm_perl: Added pair EAP-Type = MS-CHAP-V2
rlm_perl: Added pair State = 0xfeecb38bffe5a965a0ca1cd92ce6c42b
rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1
rlm_perl: Added pair Auth-Type = EAP
rlm_perl: Added pair Proxy-To-Realm = LOCAL
++[perl] returns updated
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[eap] Freeing handler
++[eap] returns ok
Login OK: [ISD\\josh] (from client CCISD-REMC-Radius port 0 via TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 2
EAP-Message = 0x03090004
Message-Authenticator = 0x00000000000000000000000000000000
User-Name = "ISD\\josh"
[peap] Got tunneled reply RADIUS code 2
EAP-Message = 0x03090004
Message-Authenticator = 0x00000000000000000000000000000000
User-Name = "ISD\\josh"
[peap] Tunneled authentication was successful.
[peap] SUCCESS
[peap] Saving tunneled attributes for later
--------- End snip of successful attempt ---------
--------- Failed attempt from user who's username begins with a "t"
(tbraun) ---------
++[files] returns noop
They key is User-Name and the value is ISD\\tbraun.They key is
EAP-Message and the value is 0x0207000f014953445c74627261756e.They key
is EAP-Type and the value is Identity.They key is FreeRADIUS-Proxied-To
and the value is 127.0.0.1.rlm_perl: Added pair User-Name = ISD\tbraun
rlm_perl: Added pair EAP-Message = 0x0207000f014953445c74627261756e
rlm_perl: Added pair EAP-Type = Identity
rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1
rlm_perl: Added pair Auth-Type = EAP
rlm_perl: Added pair Proxy-To-Realm = LOCAL
rlm_perl: Added pair EAP-Type = MS-CHAP-V2
++[perl] returns updated
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Identity does not match User-Name, setting from EAP Identity.
[eap] Failed in handler
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [ISD\tbraun] (from client CCISD-REMC-Radius port 0 via
TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 3
[peap] Got tunneled reply RADIUS code 3
[peap] Tunneled authentication was rejected.
[peap] FAILURE
----------- End of snip of failed attempt ----------------
----------- Begin paste of perl script ------------------
#!/usr/bin/perl -w
use strict;
# use ...
use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK);
use Data::Dumper;
# This is hash wich hold original request from radius
#my %RAD_REQUEST;
# In this hash you add values that will be returned to NAS.
#my %RAD_REPLY;
#This is for check items
#my %RAD_CHECK;
#
# This the remapping of return values
#
use constant RLM_MODULE_REJECT=> 0;# /* immediately reject
the request */
use constant RLM_MODULE_FAIL=> 1;# /* module failed,
don't reply */
use constant RLM_MODULE_OK=> 2;# /* the module is OK,
continue */
use constant RLM_MODULE_HANDLED=> 3;# /* the module handled
the request, so stop. */
use constant RLM_MODULE_INVALID=> 4;# /* the module
considers the request invalid. */
use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request
(user is locked out) */
use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */
use constant RLM_MODULE_NOOP=> 7;# /* module succeeded
without doing anything */
use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */
use constant RLM_MODULE_NUMCODES=> 9;# /* How many return
codes there are */
# Function to handle authorize
sub authorize {
my $sambagroup = "10007"; #This is the numeric ID of the samba group
my $domain = "ISD";
#Testing stuff to print out all radius attributes from hash
my $key = "";
my $value = "";
while (($key, $value) = each (%RAD_REQUEST)){
print "They key is $key and the value is $value.";
}
#End of testing
my $auth_user = $RAD_REQUEST{'User-Name'};
#Windows adds host/ to the begining of every machine name during
login.
#The following block of code cleans off host/ and replaces it with
#the login domain and tags a $ at the end for wbinfo group query.
if ($auth_user =~ /\bhost\b/ ) {
$auth_user =~ s/^host\/// ;
$auth_user = "$auth_user\$";
}
#Here I add the domain to the beginning of the username if the
domain doesnt exist there
#already.
if ( $auth_user !~ /^\b$domain\b/ ) {
$auth_user = "$domain\\\\$auth_user";
}
#End of username/machine name cleanup.
#The next line is the wbinfo query to see what samba groups the
user is a member of.
my @resultArray = qx(wbinfo -r $auth_user);
my $arraySize = scalar @resultArray;
my $groupID = "";
if ($arraySize != 0) {
foreach $groupID (@resultArray) {
if ($groupID == $sambagroup) {
#The below line re-writes the value stored in
#the radius user-name attribute in the rad_request
#hash. For some reason freeradius feeds in
#DOMAIN\\\\username instead of DOMAIN\\username.
#This causes the eap module to fail because the
#returned value from this module doesnt match the EAP
#identity.
#this is from testing --> $RAD_REQUEST{'User-Name'}
= "ISD\\\\tbraun"
#The following line cleans two of the slashes "\\"
out of the user-name before we return from the
#perl module. These two slashes get added in. I'm
not sure how or why.
$RAD_REQUEST{'User-Name'} =~ s/^$domain\\/$domain/;
#Here I exit the subroutine and tell FreeRadius I
updated
#some junk.
return RLM_MODULE_UPDATED;
# return RLM_MODULE_OK;
}
}
}
else {
#user not in the required group.
return RLM_MODULE_REJECT; #YOU have been denied....
}
}
