January 2012 - Freeradius-Users - lists.freeradius.org

Re: self-signed root CA
by Alan Buxey 27 Jan '12

27 Jan '12

I wouldn't normally support them but in fact Microsoft have some very good documentation for EAP-TLS on the Windows platform. Granted, not very user friendly for finding it on their MSDN (which my phone spell-checker wants to change to madness ;) ) or knowledgebase pages...but that's what Google is for. OSX on the other hand....why oh why did they [Apple] do THAT for the Lion release?? :( alan -- This smartphone has free worldwide WiFi access using eduroam. Now. that IS smart.

1 0

Service radiusd Start vs radiusd
by eric.chang 26 Jan '12

26 Jan '12

Hi guys, Whats the different between command: # Service radiusd start # radiusd when i use radiusd or radiusd -X everything works fine. but when i use service radiusd start, i have problem connecting with the postgresql DB. Log: (radiusd) Thu Jan 26 08:38:10 2012 : Info: Loaded virtual server inner-tunnel Thu Jan 26 08:38:10 2012 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Jan 26 08:38:10 2012 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:5432/radiusdb Thu Jan 26 08:38:10 2012 : Info: Loaded virtual server <default> Thu Jan 26 08:38:10 2012 : Info: Ready to process requests. Thu Jan 26 08:38:16 2012 : Info: Exiting normally. (service radiusd start) Thu Jan 26 08:39:23 2012 : Info: Loaded virtual server inner-tunnel Thu Jan 26 08:39:23 2012 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Jan 26 08:39:23 2012 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:5432/radiusdb Thu Jan 26 08:39:23 2012 : Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusd@localhost:radiusdb Thu Jan 26 08:39:23 2012 : Error: rlm_sql (sql): Failed to connect DB handle #0 Thu Jan 26 08:39:23 2012 : Info: Loaded virtual server <default> Thu Jan 26 08:39:23 2012 : Info: Ready to process requests. Thu Jan 26 08:39:28 2012 : Info: Exiting normally. Thanks Eric -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 16

freradius Segmentation fault
by Ski Mountain 26 Jan '12

26 Jan '12

I am testing out authentication with radtest. If I send the wrong group password I get "invalid Message-Authenticator" which is what I expect, the second I put in the correct password I get the "Segmentation fault" This is on Ubuntu 10.04.3 LTS. Is this a knows issue, or am I screwing something up? Thanks :/etc/freeradius# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 5 2010 at 02:49:11 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radie" password = "global" radius_db = "freeradius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radie@localhost:/freeradius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 45010, id=52, length=95 User-Name = "testemail(a)domaintest.de" User-Password = "hM0d6Z6xx4" NAS-IP-Address = 44.44.80.249 NAS-Port = 1813 Message-Authenticator = 0xe87c8ae1c74622f9ecac5b64204ccb13 +- entering group authorize {...} Segmentation fault

3 3

Freeradius and rlm_perl auth
by Fabricio Flores 26 Jan '12

26 Jan '12

Hello I´m using a perl script to authenticate in a web services. My scrpit works with the web services but I want that with my scrpit authenticate in a freeradius server. I don´t know wich files I must modify and what I must modify to it works. Thaks for your answers. -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

1 0

Re: mschap/NTLM and different membership-of with variables
by Gonzalo 26 Jan '12

26 Jan '12

sorry, I found my mistake and was on the AP device. the "outer.reply" work fine. But still want understand how this work so , if somebody can share a link that's explain how variables work in detail, it will be appreciate. Thanks. Gonzalo. -- View this message in context: http://freeradius.1045715.n5.nabble.com/mschap-NTLM-and-different-membershi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Changing domain for ntlm_auth
by NdK 26 Jan '12

26 Jan '12

Hi all. To let (most (*)) users login with their e-mail address, I'd need to "translate" the realm part to a domain. So I added to proxy.conf : realm PERSONALE { } realm STUDENTI { } realm "~^studio\\.unibo\\.it" { Realm := "STUDENTI" } realm "~^studio\\.unibo\\.it" { Realm := "PERSONALE" } realm "~^unibo\\.it" { Realm := "PERSONALE" } What I thought it would do was "if user name is like '@studio.unibo.it' then set REALM to be local 'STUDENTI'" but obviously I was wrong... Request is EAP-PEAP-MSChapv2 and the authentication oracle is an AD node (hence the use of ntlm_auth). If I authenticate using user@PERSONALE it works perfectly. What am I missing? (*) Just 'most' users since I couldn't yet find a way to use the UPN, so users whose UPN have been changed must login with their 'base' name. Don't think there's an easy fix for this, since even joined win machines *sometimes* refuse the changed UPN... Tks, Diego.

4 16

Organizing accounting attributes
by Aurélien Lafranchise 26 Jan '12

26 Jan '12

Hi All ! Is it possible to sort accounting attributes and values in a certain order under the detail files ? I manage to remove some unwanted attributes receives but I can't sort the others. Thanks for your replies. Aurélien Lafranchise Network Operations Manager Mob.: +33 (0)6 03 88 36 26 Fax: +33 (0)4 83 33 45 61 eMail: aurelien.lafranchise(a)mobiquithings.com Web: http://www.mobiquithings.com

2 2

Juniper Questions (MX/ERX)
by Paul Stewart 25 Jan '12

25 Jan '12

Hi there.. I'm trying to get an understanding on a FreeRadius installation how to enable the unisphere.dictionary. There are specific attributes in that file that we need such as "Unisphere-Ingress-Policy-Name". By default, this dictionary file is commented out due to "attribute conflicts". Can someone share a bit more info? I need unisphere attributes and also erx attributes to function on the same FreeRadius system ultimately .. We have a mixture of Juniper ERX equipment and Juniper MX equipment that needs to talk to FreeRadius. When I try to add a "Unisphere-Ingress-Policy-Name = 512k" for example in the users file I get "invalid integer" error. Thanks for any insight. Paul

5 4

request tracking
by Travis Dimmig 25 Jan '12

25 Jan '12

How does freeRadius track requests? I get errors along the lines of "Error: Discarding duplicate request from client [IP REDACTED]:49603 - ID: 204 due to unfinished request 298385" Far more often than I believe I should. What does it mean for a request to be unfinished, and how does freeRadius determine that a request is a duplicate? Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

3 4

Authentication with multiple AD
by Pavel Klochan 25 Jan '12

25 Jan '12

Hi. I need advise/help with my problem. I'm trying to authenticate with 2 LDAP-servers from freeradius, but without success. I have two AD with different domains (e.g. domain1 and domain2, and they are not linked). I'm trying to authenticate by UPN (username@domainX). I thought it would be possible to regexp User-Name in Authenticate section and substitute values of LDAP config, but it doesn't work. In sites-enables/default Authenticate section: if (User-Name =~ /domain1/i) { Server1 } elsif (User-Name =~ /domain2/i) { Server2 } in modules/ldap I have: ldap Server1 { server = "x.x.x.x" identity = "user" password = pass basedn = "DC=example1,DC=com" filter = "(userPrincipalName=%{User-Name})" ldap_connections_number = 5 timeout = 10 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes } ldap Server2 { server = "x.x.x.x" identity = "user" password = pass basedn = "DC=example2,DC=com" } filter = "(userPrincipalName=%{User-Name})" ldap_connections_number = 5 timeout = 10 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes # ldap_debug = 0xFFFF } If user@domain1 (on any other) belongs to group "mobile" in AD - I send Access-Accept. When I start FreeRadius in debug mode - I don't see any regexp information. With current config-file freeradius will use only ldap server2 to authenticate users. Is any way to te authenticate with multiple AD Thanks

2 1