- Freeradius-Users - lists.freeradius.org

Re: Freeradius How to integrate ActiveDirectory[ADIntegrationWindowsXP NTLM Tutorial]
by darkblue 03 Dec '05

03 Dec '05

hey, guys I have built up the whole environment, very close to success, but still have a problem when the suppliant create tls tunnel with radius server, the following is the log: rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 55 modcall: group authenticate returns invalid for request 55 auth: Failed to validate the user. any suggestion? I had imported the root.p12 to winxp, copy the whole certs from freeradius's source package to /usr/local/etc/raddb/certs/ 2005/12/3, freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org >: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] (Nicolas Baradakis) > 2. Re: IPv6 Support (Nicolas Baradakis) > 3. EAP/TLS Configuration - Addition (Madhuraka Godahewa) > 4. Re: EAP/TLS Configuration - Addition (Zoltan Ori) > 5. Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] (darkblue) > 6. RE: Freeradius How to integrate Active Directory and return > group attribute to VPN Concentrator (Alhagie Puye) > 7. Re: Configuring a proxied and local authentication (Alan DeKok) > 8. RE: Freeradius How to integrate Active Directory [AD > Integration WindowsXP NTLM Tutorial] (Bohannan, Chad W) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 2 Dec 2005 12:41:39 +0100 > From: Nicolas Baradakis <nbk(a)sitadelle.com > > Subject: Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] > To: darkblue <darkblue2000(a)gmail.com> > Cc: freeradius-users(a)lists.freeradius.org > Message-ID: <20051202114139.GB7382(a)asuka.tech.sitadelle.com> > Content-Type: text/plain; charset=us-ascii > > darkblue wrote: > > > I have upgrade my libs, but when execute dpkg-buildpackage -uc > > -b(under root privilege), some error show out: > > ..... > > /bin/bash: line 1: dpatch: command not found > > make: *** [unpatch] Error 127 > > > > any idea? > > apt-get install dpatch > > -- > Nicolas Baradakis > > > > ------------------------------ > > Message: 2 > Date: Fri, 2 Dec 2005 13:03:14 +0100 > From: Nicolas Baradakis <nbk(a)sitadelle.com> > Subject: Re: IPv6 Support > To: FreeRadius users mailing list > < freeradius-users(a)lists.freeradius.org> > Message-ID: <20051202120314.GC7382(a)asuka.tech.sitadelle.com> > Content-Type: text/plain; charset=us-ascii > > Paulo Alexandre Caceres Ferreira wrote: > > > How I can test IPv6 Freeradius authentication? > > You know any IPv6 RADIUS client to interact with Freeradius and perform > an > > IPv6 authentication? > > There is a program called "radclient" in the FreeRADIUS source tree. > > -- > Nicolas Baradakis > > > ------------------------------ > > Message: 3 > Date: Fri, 02 Dec 2005 19:53:09 -0800 (PST) > From: Madhuraka Godahewa <maduraka(a)electroteks.com> > Subject: EAP/TLS Configuration - Addition > To: FreeRADIUS < freeradius-users(a)lists.freeradius.org> > Message-ID: <1133581989.439116a523cff(a)mail-egn.electroteks.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi Again, > > This email refers to the earlier email sent with the subject "EAP/TLS > Configuration". > > After having some trouble with the Windows XP and freeRADIUS, I was able > to > connect to the AP. But, in the configuration (Windows XP), I removed the > check > mark at 'Validate Server Certificate'. Then, suddenly, it started working. > > Anybody knows the reason for this? > > > Further, after establishing the connection, I terminated the connection > (by > disabling the network connection). Then, I tried to connect again (by > enabling). But, this time, the user machine connected to the AP > automatically > (without asking for the credentials.). It seems like something has cached > these > entries. > > Anybody knows how to clear this cache? > > > Thanking You., > > > -------------------------------------------------------------------------------- > Madhuraka Godahewa > Telecommunications Engineer > Research and Development Unit > Electroteks Global Networks (Pvt.) Ltd. > > Mobile: + 94-777-647055 > > > ------------------------------ > > Message: 4 > Date: Fri, 2 Dec 2005 08:40:00 -0500 > From: Zoltan Ori <z.ori(a)morehead-st.edu> > Subject: Re: EAP/TLS Configuration - Addition > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: < 200512020840.00682.z.ori(a)morehead-st.edu> > Content-Type: text/plain; charset="iso-8859-1" > > On Friday 02 December 2005 22:53, Madhuraka Godahewa wrote: > > > After having some trouble with the Windows XP and freeRADIUS, I was able > to > > connect to the AP. But, in the configuration (Windows XP), I removed the > > check mark at 'Validate Server Certificate'. Then, suddenly, it started > > working. > > > > Anybody knows the reason for this? > > > > You don't have a copy of the root certificate on the supplicant or have > not > selected to use it? > > > > > Further, after establishing the connection, I terminated the connection > (by > > disabling the network connection). Then, I tried to connect again (by > > enabling). But, this time, the user machine connected to the AP > > automatically (without asking for the credentials.). It seems like > > something has cached these entries. > > > > Anybody knows how to clear this cache? > > > > It's in the registry under HKEY_CURRENT_USER\Software\Microsoft\EAPOL. > > > > ------------------------------ > > Message: 5 > Date: Fri, 2 Dec 2005 23:12:15 +0800 > From: darkblue <darkblue2000(a)gmail.com> > Subject: Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] > To: freeradius-users(a)lists.freeradius.org > Message-ID: <2c8195ff0512020712m52aac54bl(a)mail.gmail.com > > Content-Type: text/plain; charset=ISO-8859-1 > > thanks > I could not wait to complie from source tarball. > I will try the build deb some time later, anyway, thanks very much. > > 2005/12/2, Nicolas Baradakis < nbk(a)sitadelle.com>: > > darkblue wrote: > > > > > I have upgrade my libs, but when execute dpkg-buildpackage -uc > > > -b(under root privilege), some error show out: > > > ..... > > > /bin/bash: line 1: dpatch: command not found > > > make: *** [unpatch] Error 127 > > > > > > any idea? > > > > apt-get install dpatch > > > > -- > > Nicolas Baradakis > > > > > > > -- > He is nothing > > > > ------------------------------ > > Message: 6 > Date: Fri, 2 Dec 2005 10:50:31 -0500 > From: "Alhagie Puye" < APuye(a)datawave.com> > Subject: RE: Freeradius How to integrate Active Directory and return > group attribute to VPN Concentrator > To: "FreeRadius users mailing list" > < freeradius-users(a)lists.freeradius.org> > Message-ID: > <6B865826E860EF42B3A387A03F39539606D7A0A9(a)EX0004.AllstreamITS.local > > > Content-Type: text/plain; charset="us-ascii" > > > >-----Original Message----- > > >From: freeradius-users-bounces(a)lists.freeradius.org > > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > > >Behalf Of Dusty Doris > > >Sent: November 30, 2005 7:16 AM > > >To: FreeRadius users mailing list > > >Subject: RE: Freeradius How to integrate Active Directory > > >and return group attribute to VPN Concentrator > > > > > >> Radiusd.conf: > > >> > > >> filter = > > >> > > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > > >rOf=CN=rp > > >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > > >> > > >> This works fine. However I can't get it to return any > > >replyItems. Has > > >> anyone gotten this to work with Active Directory? All the > > >docs I see > > >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > > >folks out > > >> there running Windows 2000/2003 Active Directory. > > >> > > >> I have spent a couple of days on this not having much > > >luck. Here are a > > >> few questions that would help me a bit. > > >> > > >> 1) Do I need groupname_attribute to get this to work? > > >> > > >> 2) What about groupmembership_filter and groupmembership_attribute? > > >> > > >> My ldap.attrmap looks like this: > > >> > > >> replyItem Class groupofnames > > >> replyItem Class group > > >> > > >> I think the above is correct. Can some shed some light on this? > > > > > >Is group and groupofnames something that is an attribute of > > >a user? When freeradius searches for reply items it is > > >searching for attributes of that user. > > > > > >eg: > > > > > >dn: cn=someuser,... > > >group: somegroup > > > > > >Should then add > > > > > >Class = somegroup > > > > > >to the reply items. > > > > > >If you want to make reply items attached to a group, rather > > >than in individual, you will need to set the User-Profile attribute. > > > > > >For example, > > > > > >dn: cn=somegroup,ou=groups,... > > >group: somegroup > > > > > >Then in the users file. > > > > > >DEFAULT Ldap-Group == somegroup, User-Profile := > > >"cn=somegroup,ou=groups,..." > > > > > >You may be able to do this dynamically using xlat or > > >something like huntgroups too. If you want an example, send > > >us an example of a user and group from AD in ldif format and > > >an example of a radius packet that you would expect in the > > >reply and I'll see if I can come up with an idea for ya. > > I'm still waiting for some help with this.....I have sent all the > information that you requested. > I have gotten it to return the group name but it is also returning the > username as well and the username is returned after the group name. Is > there is way to return just the groupname? > I really would like to resolve this issue ones and for all. > > I'm really surprised that there are not folks on the list who have > Active Directory users that they want to use to lock VPN users into > groups on the VPN Concentrator. If really there isn't, I would put a > howto on this when I get it working and post it on the list. > > Here is my latest output: > > rlm_ldap: performing search in CN=itops,OU=Information > Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave, with filter > (cn=itops) > rlm_ldap::ldap_groupcmp: User found in group itops > rlm_ldap: ldap_release_conn: Release Id: 0 > users: Matched entry DEFAULT at line 163 > modcall[authorize]: module "files" returns ok for request 1 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for apuye > radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' > radius_xlat: 'DC=corp,DC=van,DC=dwave' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter > (&(sAMAccountName=apuye)(objectclass=user)) > rlm_ldap: performing search in CN=itops,ou=Information > Technology,ou=Datawave Users,dc=corp,dc=van,dc=dwave, with filter > (objectclass=group) > rlm_ldap: Adding samaccountname as Class, value itops & op=11 > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding samaccountname as Class, value apuye & op=11 > rlm_ldap: user apuye authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 1 > modcall: group authorize returns ok for request 1 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group Auth-Type for request 1 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "apuye" with password "XXXXXXXXXXX" > rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave > Users,DC=corp,DC=van,DC=dwave > rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 1 > rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave > Users,DC=corp,DC=van,DC=dwave/XXXXXXXXXX to huckster.corp.van.dwave:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: user apuye authenticated succesfully > modcall[authenticate]: module "ldap" returns ok for request 1 > modcall: group Auth-Type returns ok for request 1 > Sending Access-Accept of id 4 to 10.99.1.50:1031 > Class = 0x6170757965 > Finished request 1 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 1 ID 4 with timestamp 438e98b2 > Nothing to do. Sleeping until we see a request. > > Thanks, > Alhagie. > > > > > > > > > > > >- > > >List info/subscribe/unsubscribe? See > > >http://www.freeradius.org/list/users.html > > > > > > This message (including any attachments) is confidential, may be > privileged and is only intended for the person to whom it is addressed. If > you have received it by mistake please notify the sender by return e-mail > and delete this message from your system. Any unauthorized use or > dissemination of this message in whole or in part is strictly > prohibited. E-mail communications are inherently vulnerable to interception > by unauthorized parties and are susceptible to change. We will use > alternate communication means upon request. > > > > ------------------------------ > > Message: 7 > Date: Fri, 02 Dec 2005 12:16:46 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: Configuring a proxied and local authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: < 20051202171647.EF63016CC1(a)mail.nitros9.org> > > Samuel Degrande <Samuel.Degrande(a)lifl.fr> wrote: > > I don't find a way to add a NAS-Identifier value inside the proxied > > request, so that B server could check it... > > That's because the NAS didn't send it. FreeRADIUS doesn't add one, > so... > > > I tried: > > <username> Proxy-To-Realm := <realm>, NAS-Identifier := <id> > > and > > <username> Proxy-To-Realm := <realm>, NAS-Identifier += <id> > > That won't work in the "users" file. You have to set the > NAS-Identifier in the preproxy_users file. > > > How to configure the A server so that if B rejects the request, then > > A will check in a local user base (through pam) ? > > That's a little harder. The server isn't designed to do that easily. > > Alan DeKok. > > > > ------------------------------ > > Message: 8 > Date: Fri, 2 Dec 2005 12:46:47 -0500 > From: "Bohannan, Chad W" <Chad_Bohannan(a)reyrey.com> > Subject: RE: Freeradius How to integrate Active Directory [AD > Integration WindowsXP NTLM Tutorial] > To: "FreeRadius users mailing list" > < freeradius-users(a)lists.freeradius.org> > Message-ID: > <7EA2A14F52A15A49807388D4A6AD624613619741(a)OH18CL07VE1.reyrey.com > > Content-Type: text/plain; charset="us-ascii" > > We were able to move past this particular problem. For anyone who may > have a similar issue.... > > Port 512 (tcp&udp for EZEC service) need to be allowed in addition to > the standard 137-139, 445, & 389. So if you are running TCP wrappers or > ip tables make certain it is allowed.... > > cheers > > > > -----Original Message----- > From: Bohannan, Chad W > Sent: Thursday, December 01, 2005 11:27 AM > To: 'charles schwartz'; 'FreeRadius users mailing list' > Subject: RE: Freeradius How to integrate Active Directory [AD > Integration WindowsXP NTLM Tutorial] > > > > Hello, > I am attempting to have FR authenticate administrative access > for my Cisco gear against AD. The problem I am having is this. When I > attempt to join the realm <<net ads join -U UID>> the command appears > successful and from the AD side, the system has joined (visable in AD), > however the proccess hangs on the FR side. If I stop the process and > reissue the command, I get the following output and the process again > hangs: > > [2005/12/01 11:08:36, 0] libads/ldap.c:ads_add_machine_acct(1405) > ads_add_machine_acct: Host account for rws-radius01 already exists - > modifying old account > > > <<ntlm_auth --request-nt-key --domain=mydomain --username= \myuid>> > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > > <<wbinfo -a UID%PASSWD>> > > plaintext password authentication failed > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > error messsage was: No such user > Could not authenticate user UID%PASSWD with plaintext password > challenge/response password authentication failed > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > Could not authenticate user UID with challenge/response > > I am sure there is something simple I have overlooked, but I am unable > to find it at this point. Any suggestions would be much appreciated. > > > Chad > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > charles schwartz > Sent: Tuesday, November 22, 2005 11:28 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius How to integrate Active Directory [AD Integration > WindowsXP NTLM Tutorial] > > > Hi list, > > A lot of people on this list would like to integrate Active Directory > with FreeRADIUS in order to provide a transparent user authentication > login process. > > There are at least 2 ways to integrate AD: LDAP and NTLM. > I've written a tutorial about how to do this with NTLM (winbind, > ntlm_auth). The Windows supplicants are configured to work with PEAP and > MSCHAPv2. > > You can download it from here: > http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf > > Good luck! > > Regards, > Charles Schwartz > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > End of Freeradius-Users Digest, Vol 8, Issue 10 > *********************************************** > -- He is nothing

3 2

acct info for visp authentication
by squirrel＠isot.com 03 Dec '05

03 Dec '05

I get acct info for my local nas, but not getting acct info on visp authentication? I've just upgraded to v1.0.5, but no difference. What does it take to get the acct info for visp authentications? ************************************** Computer problems? ................... ..............http://www.multibyte.net

3 4

RADIUS Auth-Type
by Bohannan, Chad W 03 Dec '05

03 Dec '05

OK, here is the situation. I have successfully configured RADIUS to authenticate/authorize NAS requests from my Cisco gear so long as the user "Auth-Type= System". I have also managed to get Samba working and have joined the radius server to the AD realm in question. This is confirmed through the following: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYUID password:xxxxx NT_STATUS_OK: Success (0x0) wbinfo -a MYUID%MYPASSWD plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user MYUID%MTPASSWD with plaintext password challenge/response password authentication succeeded However, when I edit the /etc/raddb/users file and change the "Auth-Type= System" to "Auth-Type=MSCAP" all authentication attempts fail. Am I specifying the correct auth-type? Have I missed a step? Is there something I can do (debug maybe) that will better assist in identifying the problem? Any and all suggestions are appreciated. I am attempting to have RADIUS proxy authentication requests to AD, then assign attributes if authentication succeeds. Chad

2 1

EAP/TLS Configuration
by Madhuraka Godahewa 02 Dec '05

02 Dec '05

Hi All, I installed freeRADIUS 1.0.5 recently, and configured the server as described in the documentation files. I configured it (freeRADIUS) to accept incoming authentication requests from a WLAN AP (10.128.253.122). (Thanks for everyone who helped me throughout.) Then, using the OpenSSL, I created Server and Client Certificates to work with EAP/TLS. I also configured user (Windows XP) to connect to the network through the AP. When I am trying to connect to the network, the AP sends the access-request to the freeRADIUS server and the output of the 'radiusd -X' is as follows. < rad_recv: Access-Request packet from host 10.128.253.122:2049, id=0, length=145 User-Name = "rajith-office" NAS-IP-Address = 10.128.253.122 Called-Station-Id = "001310e7f2a3" Calling-Station-Id = "00121764a573" NAS-Identifier = "001310e7f2a3" NAS-Port = 50 Framed-MTU = 1400 State = 0x814918fda1642f41b8a502c6a199d9dc NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x6f24ef63df0ac05fc0eea5bae2c6db30 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 23 modcall[authorize]: module "preprocess" returns ok for request 23 modcall[authorize]: module "chap" returns noop for request 23 modcall[authorize]: module "mschap" returns noop for request 23 rlm_realm: No '@' in User-Name = "rajith-office", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 23 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 23 users: Matched rajith-office at 156 modcall[authorize]: module "files" returns ok for request 23 modcall: group authorize returns updated for request 23 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 23 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 23 modcall: group authenticate returns ok for request 23 Sending Access-Accept of id 0 to 10.128.253.122:2049 MS-MPPE-Recv-Key = 0x2360910dc1d2c0525aabfbe09a803b23d3b36957a3d2751fea8e6cadd83a2001 MS-MPPE-Send-Key = 0x634f3a8d4247469db34585005a67c4d46689d6047fbd70296dd9a2ea35d8e35e EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "rajith-office" Finished request 23 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 23 ID 0 with timestamp 438ffb3c Nothing to do. Sleeping until we see a request. > As it says, it sends the access-accept message to the AP. When observed the output of the tcpdump, I get the following. < tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 14:06:25.021464 IP (tos 0x0, ttl 64, id 1077, offset 0, flags [DF], length: 167) 10.128.253.122.nfs > rajith-office.radius: RADIUS, length: 139 Access Request (1), id: 0x00, Authenticator: a1e2e07e2e18f7e9342ef7ebd2b20529 Username Attribute (1), length: 15, Value: rajith-office 0x0000: 7261 6a69 7468 2d6f 6666 6963 65 NAS IP Address Attribute (4), length: 6, Value: 10.128.253.122 0x0000: 0a80 fd7a [|radius] 14:06:25.023671 IP (tos 0x0, ttl 64, id 24, offset 0, flags [DF], length: 92) rajith-office.radius > 10.128.253.122.nfs: RADIUS, length: 64 Access Challenge (11), id: 0x00, Authenticator: e7e0b48c8f87df181cca4aed4bb2f4ab EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0101 0006 0d20 Message Authentication Attribute (80), length: 18, Value: . ..q*....X..... 0x0000: 8820 1ebc 712a 1b84 c4b2 58bf 96bd f3ef [|radius] 14:06:25.247782 IP (tos 0x0, ttl 64, id 1078, offset 0, flags [DF], length: 247) 10.128.253.122.nfs > rajith-office.radius: RADIUS, length: 219 Access Request (1), id: 0x00, Authenticator: f6feb52cb3ffb9e92651be66e9ab549e Username Attribute (1), length: 15, Value: rajith-office 0x0000: 7261 6a69 7468 2d6f 6666 6963 65 NAS IP Address Attribute (4), length: 6, Value: 10.128.253.122 0x0000: 0a80 fd7a [|radius] 14:06:25.250218 IP (tos 0x0, ttl 64, id 25, offset 0, flags [DF], length: 919) rajith-office.radius > 10.128.253.122.nfs: RADIUS, length: 891 Access Challenge (11), id: 0x00, Authenticator: 218ca3fafe6f1c3b007d5ae8b7cdd40a [|radius] 14:06:25.274389 IP (tos 0x0, ttl 64, id 1079, offset 0, flags [DF], length: 173) 10.128.253.122.nfs > rajith-office.radius: RADIUS, length: 145 Access Request (1), id: 0x00, Authenticator: e26c1b74318e971004e1fac2c3b5b1ea Username Attribute (1), length: 15, Value: rajith-office 0x0000: 7261 6a69 7468 2d6f 6666 6963 65 NAS IP Address Attribute (4), length: 6, Value: 10.128.253.122 0x0000: 0a80 fd7a [|radius] 14:06:25.275289 IP (tos 0x0, ttl 64, id 26, offset 0, flags [DF], length: 203) rajith-office.radius > 10.128.253.122.nfs: RADIUS, length: 175 Access Accept (2), id: 0x00, Authenticator: 4af05501f464f4080afcce604e2c5f24 [|radius] > But, the problem is, the user machine (one that is running Windows XP) does not connect to the network. It again asks for the 'User Credentials'. Does anyone know where the problem lies? Thanking You. -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

1 0

RE: Freeradius How to integrate Active Directory and return groupattribute to VPN Concentrator
by Alhagie Puye 02 Dec '05

02 Dec '05

Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: December 2, 2005 10:11 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return groupattribute to VPN Concentrator > > > >On Wed, 30 Nov 2005, Alhagie Puye wrote: > > > >> Ok, So I played around some more with the settings. > >> > >> Actually "group" and "groupofnames" are not correct > >attributes for user. > >> > >> It is supposed to be "memberof". So I changed line in > >ldap.attrmap to > >> look like: > >> > >> replyItem Class memberof > >> > >> Now I'm getting replyItems but the data looks like > >garbage. I want it > >> to return the group name. > >> > > > >You are returning CN as the class in your radius packet. > > > >Class = CN > > > >Class is not a string, its an octet so what you are seeing > >434e is really CN. You must be returning something like > > > >memberof: CN=somegroup,ou=someou,... Yes, you are absolutely correct. I have now installed and configured OpenLdap and followed your intructions to the teeth because this is driving me to the wall. If I have to implement OpenLDAP to get this working, then that's what I will do....... Here is what I'm getting now: Cleaning up request 0 ID 183 with timestamp 4390a566 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:44210, id=250, length=57 User-Name = "user2" User-Password = "whatever" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_realm: No '@' in User-Name = "user2", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'DC=mydomain,DC=com' radius_xlat: '(uid=user2)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=mydomain,DC=com, with filter (uid=user2) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(uid=user2))(objectclass=radiusprofile)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=mydomain,DC=com, with filter (&(radiusGroupName=disabled)(&(uid=user2))(objectclass=radiusprofile)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in uid=user2,ou=users,ou=radius,dc=mydomain,dc=com, with filter (objectclass=*) rlm_ldap::groupcmp: Group disabled not found ????or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'DC=mydomain,DC=com' radius_xlat: '(&(uid=user2))(objectclass=radiusprofile)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=mydomain,DC=com, with filter (&(radiusGroupName=dial)(&(uid=user2))(objectclass=radiusprofile)) rlm_ldap::ldap_groupcmp: User found in group dial rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 169 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for user2 radius_xlat: '(uid=user2)' radius_xlat: 'DC=mydomain,DC=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=mydomain,DC=com, with filter (uid=user2) rlm_ldap: performing search in uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com, with filter (objectclass=radiusprofile) rlm_ldap: Adding radiusFramedRouting as Framed-Routing, value None & op=11 rlm_ldap: Adding radiusFramedIPNetmask as Framed-IP-Netmask, value 255.255.255.0 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: Added password whatever in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusgroupname as Class, value dial & op=11 rlm_ldap: Adding radiusgroupname as Class, value isdn & op=11 rlm_ldap: user user2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "user2" with password "whatever" rlm_ldap: user DN: uid=user2,ou=users,ou=radius,dc=mydomain,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=user2,ou=users,ou=radius,dc=mydomain,dc=com/whatever to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user user2 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 250 to 127.0.0.1:44210 Framed-Routing = None Framed-IP-Netmask = 255.255.255.0 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6469616c Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 250 with timestamp 4390a725 Nothing to do. Sleeping until we see a request. Dusty, I know you mentioned that you are implementing what I'm trying to achieve with the Cisco VPN Concentrator. Is this what I SHOULD expect to my setup to work? Thanks in advance, Alhagie. > > > >It seems like rlm_ldap is stripping anything after that = > >sign. You should check the bugs db and see if you can find > >something like this. > > > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Configuring a proxied and local authentication
by Samuel Degrande 02 Dec '05

02 Dec '05

Hello. Fist, I would like to apologize if my question is really too simple, but I think that I don't exactly understand the configuration philosophy of freeradius. I did configure one radius server (A) to proxy incoming requests to an other radius server (B, this later one using pam). First question: I don't find a way to add a NAS-Identifier value inside the proxied request, so that B server could check it... I tried: <username> Proxy-To-Realm := <realm>, NAS-Identifier := <id> and <username> Proxy-To-Realm := <realm>, NAS-Identifier += <id> (i'm using radtest to check my configuration, perhaps it's the problem ?) Second question: How to configure the A server so that if B rejects the request, then A will check in a local user base (through pam) ? As I said, I'm just perhaps too bad, and did not understand how all this thing works, but please help me anyway :-) Thanks. -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 3

LDAP, FreeRadius, and Schema
by Matt Juszczak 02 Dec '05

02 Dec '05

Hi all, I was wondering what everyone uses for an account objectClass? Right now I'm using "Person", which makes the dn: cn=<user>,ou=Radius,dc=mydomain,dc=net However, indexing the cn would index the CN of other OU's as well ... . I'm just wondering what people use. I know "Account" could also be used. Regards, Matt

3 3

RE: Freeradius How to integrate Active Directory and return groupattribute to VPN Concentrator
by Alhagie Puye 02 Dec '05

02 Dec '05

Ok, So I played around some more with the settings. Actually "group" and "groupofnames" are not correct attributes for user. It is supposed to be "memberof". So I changed line in ldap.attrmap to look like: replyItem Class memberof Now I'm getting replyItems but the data looks like garbage. I want it to return the group name. Here is the output: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 1 status: Connected last used: Wed Nov 30 15:43:08 2005 ** Outstanding Requests: * msgid 19, origid 16, status InProgress outstanding referrals 0, parent count 1 * msgid 17, origid 16, status Request Completed outstanding referrals 0, parent count 1 * msgid 16, origid 16, status Request Completed outstanding referrals 1, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-result msgid 19, original id 16 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 19 merged parent (id 16) error info: result errno 0, error <>, matched <> request 16 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 16, msgid 16) ldap_free_request (origid 16, msgid 19) ldap_free_request (origid 16, msgid 17) ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed adding response id 16 type 101: ldap_parse_result ldap_get_dn ldap_get_values rlm_ldap: looking for check items in directory... ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: looking for reply items in directory... ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: Adding memberof as Class, value CN & op=11 rlm_ldap: Adding memberof as Class, value CN & op=11 rlm_ldap: Adding memberof as Class, value CN & op=11 rlm_ldap: Adding memberof as Class, value CN & op=11 ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: user apuye authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXXX" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to SERVER.corp.van.dwave:389, authentication 1 ldap_create rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXXX to SERVER.corp.van.dwave:389 ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP SERVER.corp.van.dwave:389 ldap_new_socket: 7 ldap_prepare_socket: 7 ldap_connect_to_host: Trying w.x.y.z:389 ldap_connect_timeout: fd: 7 tm: 10 async: 0 ldap_ndelay_on: 7 ldap_is_sock_ready: 7 ldap_ndelay_off: 7 ldap_open_defconn: successful ldap_send_server_request rlm_ldap: waiting for bind result ... ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, 0 usec), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 15:43:08 2005 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ldap_read: message type bind msgid 1, original id 1 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 225 to 127.0.0.1:54101 Service-Type = Login-User Class = 0x434e Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 225 with timestamp 438e390c Nothing to do. Sleeping until we see a request. Hmm....I guess I would have to send both user and group information to get this working. I would like to authenticate the user but it is actually the group name that I need returned. Here is the LDIF format for the group: dn: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave changetype: add member: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van, DC=dwave cn: itops description: IT Operations Staff dSCorePropagationData: 20041203232658.0Z dSCorePropagationData: 20041203231653.0Z dSCorePropagationData: 20041203221337.0Z dSCorePropagationData: 20040820205210.0Z dSCorePropagationData: 16020125025705.0Z mail: all-itops(a)datawave.ca groupType: -2147483646 instanceType: 4 distinguishedName: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave objectClass: group objectGUID:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== objectSid:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== name: itops sAMAccountName: itops sAMAccountType: 268435456 uSNChanged: 5713274 uSNCreated: 1615 whenChanged: 20050902200841.0Z whenCreated: 20030119021132.0Z msSFU30GidNumber: 1001 msSFU30Name: itops msSFU30NisDomain: corp It is the "name" or "sAMAccountName" attribute that I want returned when a user is authenticated. Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Alhagie Puye > >Sent: November 30, 2005 10:35 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return groupattribute to VPN Concentrator > > > >Here is an ldap query output for a user: > > > > > >waggawagga raddb # ldapsearch -LLL -h w.x.y.z -x -b > >'dc=corp,dc=van,dc=dwave' '(&(memberof=CN=rptpcps,OU=DataWave > >Users,DC=corp,DC=van,DC=dwave)(samaccountname=apuye))' -D > >apuye(a)corp.van.dwave -w XXXXXXXX > > > > > >dn: CN=Alhagie Puye,OU=Information Technology,OU=DataWave > >Users,DC=corp,DC=van ,DC=dwave > >memberOf: CN=itops-folder,OU=SHARED FOLDERS,OU=DataWave > >Users,DC=corp,DC=van,D C=dwave > >memberOf: CN=rptpcps,OU=DataWave Users,DC=corp,DC=van,DC=dwave > >memberOf: CN=itops,OU=Information Technology,OU=DataWave > >Users,DC=corp,DC=van, DC=dwave > >memberOf: CN=datawave,OU=DataWave Users,DC=corp,DC=van,DC=dwave > >accountExpires: 9223372036854775807 > >badPasswordTime: 127778245108916810 > >badPwdCount: 0 > >codePage: 0 > >cn: Alhagie Puye > >countryCode: 0 > >description: IT Operations > >displayName: Alhagie Puye > >givenName: Alhagie > >homeDirectory: \\fs1\apuye > >homeDrive: H: > >instanceType: 4 > >lastLogoff: 0 > >lastLogon: 127778426282888816 > >logonCount: 196 > >msNPAllowDialin: TRUE > >distinguishedName: CN=Alhagie Puye,OU=Information > >Technology,OU=DataWave Users ,DC=corp,DC=van,DC=dwave > >objectCategory: > >CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave > >objectClass: top > >objectClass: person > >objectClass: organizationalPerson > >objectClass: user > >objectGUID:: oO1UkRu8RkScNIOHmaB/qw== > >objectSid:: AQUAAAAAAAUVAAAAzSmuLihcKk12fipaZwkAAA== > >primaryGroupID: 513 > >profilePath: \\fs2\profiles\apuye > >pwdLastSet: 127771529310887572 > >name: Alhagie Puye > >sAMAccountName: apuye > >sAMAccountType: 805306368 > >sn: Puye > >userAccountControl: 512 > >userParameters:: > >bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI > > > >CAgUBAaCAFDdHhDZmdQcmVzZW5045S15pSx5oiw44GiGAgBQ3R4Q2ZnRmxhZ3 > >Mx44Cw44Gm4 > >6Cy44 > > > >C5FggBQ3R4Q2FsbGJhY2vjgLDjgLDjgLDjgLASCAFDdHhTaGFkb3fjhLDjgLD > >jgLDjgLAoCA > >FDdHh > > > >NYXhDb25uZWN0aW9uVGltZeOAsOOAsOOAsOOAsC4IAUN0eE1heERpc2Nvbm5l > >Y3Rpb25UaW1 > >l44Cw > > > >44Cw44Cw44CwHAgBQ3R4TWF4SWRsZVRpbWXjgLDjgLDjgLDjgLAiCAFDdHhLZ > >Xlib2FyZExh > >eW91d > > > >OOAsOOAsOOAsOOAsCoCAUN0eE1pbkVuY3J5cHRpb25MZXZlbOOEsCACAUN0eF > >dvcmtEaXJlY > >3Rvcn > > > >njgLAgAgFDdHhOV0xvZ29uU2VydmVy44CwGAIBQ3R4V0ZIb21lRGly44CwIgI > >BQ3R4V0ZIb2 > >1lRGl > > > >yRHJpdmXjgLAgAgFDdHhXRlByb2ZpbGVQYXRo44CwIgIBQ3R4SW5pdGlhbFBy > >b2dyYW3jgLA > >iAgFD > > dHhDYWxsYmFja051bWJlcuOAsA== > >userPrincipalName: apuye(a)corp.van.dwave > >uSNChanged: 7588047 > >uSNCreated: 5713011 > >whenChanged: 20051122170851.0Z > >whenCreated: 20050902184213.0Z > > > ># refldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van,DC=dwave > > > > > > > >I would like the group that the user is a member of to be > >sent back in the replyItem. I need this value for locking > >the user into groups on the Cisco VPN Concentrator. That's > >the only portion I'm missing. > > > >Here is an output of the debug when I authenticate the user: > > > >put_filter: "(cn=itops)" > >put_filter: simple > >put_simple_filter: "cn=itops" > >ldap_send_initial_request > >ldap_send_server_request > >ldap_result msgid 15 > >ldap_chkResponseList for msgid=15, all=1 > >ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, > >0 usec), msgid 15 wait4msg continue, msgid 15, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 15, origid 15, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > Empty > >ldap_chkResponseList for msgid=15, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 15, all 1 > >ldap_read: message type search-entry msgid 15, original id 15 > >wait4msg: 39 secs to go > >wait4msg continue, msgid 15, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 15, origid 15, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > * msgid 15, type 100 > >ldap_chkResponseList for msgid=15, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 15, all 1 > >ldap_read: message type search-result msgid 15, original id > >15 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 15 request 15 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 15, msgid 15) ldap_free_connection > >ldap_free_connection: refcnt 1 > >adding response id 15 type 101: > >ldap_parse_result > >ldap_msgfree > >ldap_msgfree > >rlm_ldap::ldap_groupcmp: User found in group itops > >rlm_ldap: ldap_release_conn: Release Id: 0 > > users: Matched entry DEFAULT at line 155 > > modcall[authorize]: module "files" returns ok for request 0 > >rlm_ldap: - authorize > >rlm_ldap: performing user authorization for apuye > >radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' > >radius_xlat: 'DC=corp,DC=van,DC=dwave' > >rlm_ldap: ldap_get_conn: Checking Id: 0 > >rlm_ldap: ldap_get_conn: Got Id: 0 > >rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter > >(&(sAMAccountName=apuye)(objectclass=user)) > >ldap_search > >put_filter: "(&(sAMAccountName=apuye)(objectclass=user))" > >put_filter: AND > >put_filter_list "(sAMAccountName=apuye)(objectclass=user)" > >put_filter: "(sAMAccountName=apuye)" > >put_filter: simple > >put_simple_filter: "sAMAccountName=apuye" > >put_filter: "(objectclass=user)" > >put_filter: simple > >put_simple_filter: "objectclass=user" > >ldap_send_initial_request > >ldap_send_server_request > >ldap_result msgid 16 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, > >0 usec), msgid 16 wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 16, origid 16, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > Empty > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-entry msgid 16, original id 16 > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 16, origid 16, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-reference msgid 16, original > >id 16 ldap_chase_v3referrals > >ldap_url_parse_ext(ldap://corp.van.dwave/CN=Configuration,DC= > >corp,DC=van > >,DC=dwave) > >re_encode_request: new msgid 17, new dn > ><CN=Configuration,DC=corp,DC=van,DC=dwave> > >re_encode_request new request is: > >ber_dump: buf=0x0815ec00 ptr=0x0815ef76 end=0x0815fbdc len=886 > > 0000: 72 64 72 64 00 00 00 00 00 00 00 00 00 00 00 00 > >rdrd............ > > 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0370: 00 00 00 00 00 00 ...... > > > >ldap_chase_v3referral: msgid 16, url > >"ldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van,DC=dwave" > >ldap_send_server_request > >ldap_new_connection > >ldap_int_open_connection > >ldap_connect_to_host: TCP corp.van.dwave:389 > >ldap_new_socket: 7 > >ldap_prepare_socket: 7 > >ldap_connect_to_host: Trying w.x.y.z:389 > >ldap_connect_timeout: fd: 7 tm: 10 async: 0 > >ldap_ndelay_on: 7 > >ldap_is_sock_ready: 7 > >ldap_ndelay_off: 7 > >anonymous rebind via ldap_bind_s > >ldap_bind_s > >ldap_simple_bind_s > >ldap_sasl_bind_s > >ldap_sasl_bind > >ldap_send_initial_request > >ldap_send_server_request > >ldap_result msgid 18 > >ldap_chkResponseList for msgid=18, all=1 > >ldap_chkResponseList returns NULL wait4msg (infinite > >timeout), msgid 18 wait4msg continue, msgid 18, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > rebind in progress > > queue is empty > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 18, origid 18, status InProgress > > outstanding referrals 0, parent count 0 > > * msgid 16, origid 16, status InProgress > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=18, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 18, all 1 > >ldap_read: message type search-result msgid 16, original id > >16 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 16 ldap_free_connection > >ldap_free_connection: refcnt 1 > >wait4msg continue, msgid 18, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > rebind in progress > > queue is empty > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 18, origid 18, status InProgress > > outstanding referrals 0, parent count 0 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=18, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 18, all 1 > >ldap_read: message type bind msgid 18, original id 18 new > >result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 18 request 18 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 18, msgid 18) ldap_free_connection > >ldap_free_connection: refcnt 1 > >ldap_parse_result > >ldap_msgfree > >read1msg: 1 new referrals > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 17, origid 16, status InProgress > > outstanding referrals 0, parent count 1 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-reference msgid 17, original > >id 16 ldap_chase_v3referrals > >ldap_url_parse_ext(ldap://corp.van.dwave/CN=Schema,CN=Configu > >ration,DC=c > >orp,DC=van,DC=dwave) > >re_encode_request: new msgid 19, new dn > ><CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave> > >re_encode_request new request is: > >ber_dump: buf=0x0815fbe0 ptr=0x0815ff60 end=0x08160bbc len=896 > > 0000: 72 64 72 64 00 00 00 00 00 00 00 00 00 00 00 00 > >rdrd............ > > 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > > 0370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >................ > >ldap_chase_v3referral: msgid 17, url > >"ldap://corp.van.dwave/CN=Schema,CN=Configuration,DC=corp,DC= > >van,DC=dwav > >e" > >ldap_send_server_request > >read1msg: search ref chased, mark request chasing refs, id = 17 > >read1msg: 1 new referrals > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 19, origid 16, status InProgress > > outstanding referrals 0, parent count 1 > > * msgid 17, origid 16, status ChasingRefs > > outstanding referrals 0, parent count 1 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 2, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-result msgid 17, original id > >16 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 17 merged parent (id > >16) error info: result errno 0, error <>, matched <> > >ldap_free_connection > >ldap_free_connection: refcnt 1 > >wait4msg: 39 secs to go > >wait4msg continue, msgid 16, all 1 > >** Connections: > >* host: corp.van.dwave port: 0 > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 1 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 19, origid 16, status InProgress > > outstanding referrals 0, parent count 1 > > * msgid 17, origid 16, status Request Completed > > outstanding referrals 0, parent count 1 > > * msgid 16, origid 16, status Request Completed > > outstanding referrals 1, parent count 0 > >** Response Queue: > > * msgid 16, type 100 > >ldap_chkResponseList for msgid=16, all=1 > >ldap_chkResponseList returns NULL ldap_int_select > >read1msg: msgid 16, all 1 > >ldap_read: message type search-result msgid 19, original id > >16 new result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 19 merged parent (id > >16) error info: result errno 0, error <>, matched <> request 16 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 16, msgid 16) ldap_free_request > >(origid 16, msgid 19) ldap_free_request (origid 16, msgid > >17) ldap_free_connection ldap_send_unbind > >ldap_free_connection: actually freed > >adding response id 16 type 101: > >ldap_parse_result > >ldap_get_dn > >ldap_get_values > >rlm_ldap: looking for check items in directory... > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >rlm_ldap: looking for reply items in directory... > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >ldap_get_values > >rlm_ldap: user apuye authorized to use remote access ldap_msgfree > >rlm_ldap: ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns ok for request 0 > >modcall: group authorize returns ok for request 0 > > rad_check_password: Found Auth-Type LDAP > >auth: type "LDAP" > > Processing the authenticate section of radiusd.conf > >modcall: entering group Auth-Type for request 0 > >rlm_ldap: - authenticate > >rlm_ldap: login attempt by "apuye" with password "XXXXXXXX2" > >rlm_ldap: user DN: CN=Alhagie Puye,OU=Information > >Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave > >rlm_ldap: (re)connect to SERVER.corp.van.dwave:389, > >authentication 1 ldap_create > >rlm_ldap: bind as CN=Alhagie Puye,OU=Information > >Technology,OU=DataWave > >Users,DC=corp,DC=van,DC=dwave/XXXXXXXX2 to > >SERVER.corp.van.dwave:389 ldap_bind ldap_simple_bind > >ldap_sasl_bind ldap_send_initial_request ldap_new_connection > >ldap_int_open_connection > >ldap_connect_to_host: TCP SERVER.corp.van.dwave:389 > >ldap_new_socket: 7 > >ldap_prepare_socket: 7 > >ldap_connect_to_host: Trying w.x.y.z:389 > >ldap_connect_timeout: fd: 7 tm: 10 async: 0 > >ldap_ndelay_on: 7 > >ldap_is_sock_ready: 7 > >ldap_ndelay_off: 7 > >ldap_open_defconn: successful > >ldap_send_server_request > >rlm_ldap: waiting for bind result ... > >ldap_result msgid 1 > >ldap_chkResponseList for msgid=1, all=1 > >ldap_chkResponseList returns NULL > >wait4msg (timeout 40 sec, 0 usec), msgid 1 wait4msg > >continue, msgid 1, all 1 > >** Connections: > >* host: SERVER.corp.van.dwave port: 389 (default) > > refcnt: 2 status: Connected > > last used: Wed Nov 30 10:18:54 2005 > > > >** Outstanding Requests: > > * msgid 1, origid 1, status InProgress > > outstanding referrals 0, parent count 0 > >** Response Queue: > > Empty > >ldap_chkResponseList for msgid=1, all=1 > >ldap_chkResponseList returns NULL > >ldap_int_select > >read1msg: msgid 1, all 1 > >ldap_read: message type bind msgid 1, original id 1 new > >result: res_errno: 0, res_error: <>, res_matched: <> > >read1msg: 0 new referrals > >read1msg: mark request completed, id = 1 request 1 done > >res_errno: 0, res_error: <>, res_matched: <> > >ldap_free_request (origid 1, msgid 1) ldap_free_connection > >ldap_free_connection: refcnt 1 > >ldap_parse_result > >ldap_msgfree > >rlm_ldap: Bind was successful > >rlm_ldap: user apuye authenticated succesfully > >ldap_free_connection ldap_send_unbind > >ldap_free_connection: actually freed > > modcall[authenticate]: module "ldap" returns ok for request 0 > >modcall: group Auth-Type returns ok for request 0 Sending > >Access-Accept of id 162 to 127.0.0.1:51232 > > Service-Type = Login-User > >Finished request 0 > >Going to the next request > >--- Walking the entire request list --- > >Waking up in 6 seconds... > >--- Walking the entire request list --- > >Cleaning up request 0 ID 162 with timestamp 438ded0e Nothing > >to do. Sleeping until we see a request. > > > > > >My radiusd.conf: > > > > filter = > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objec > >tclass=user > >))" > > groupname_attribute = "cn" > > groupmembership_filter = > >"(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass= > >top)(unique > >member=%{Ldap-UserDn}))" > > groupmembership_attribute = memberOf > > > > > > > > > >My ldap.attrmap: > > > > replyItem Class group > > > > > > > >My users file: > > > >DEFAULT Ldap-Group == "itops" > > Auth-Type := LDAP, > > Service-Type = Login, > > > > > > > > > >Thanks in advance > > > >Alhagie Puye - Network Engineer > >Datawave Group of Companies > >(604)295-1817 > > > >> >-----Original Message----- > >> >From: freeradius-users-bounces(a)lists.freeradius.org > >> >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of > >> >Dusty Doris > >> >Sent: November 30, 2005 7:16 AM > >> >To: FreeRadius users mailing list > >> >Subject: RE: Freeradius How to integrate Active Directory > >and return > >> >group attribute to VPN Concentrator > >> > > >> >> Radiusd.conf: > >> >> > >> >> filter = > >> >> > >> >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > >> >rOf=CN=rp > >> >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > >> >> > >> >> This works fine. However I can't get it to return any > >> >replyItems. Has > >> >> anyone gotten this to work with Active Directory? All the > >> >docs I see > >> >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > >> >folks out > >> >> there running Windows 2000/2003 Active Directory. > >> >> > >> >> I have spent a couple of days on this not having much > >> >luck. Here are a > >> >> few questions that would help me a bit. > >> >> > >> >> 1) Do I need groupname_attribute to get this to work? > >> >> > >> >> 2) What about groupmembership_filter and > >groupmembership_attribute? > >> >> > >> >> My ldap.attrmap looks like this: > >> >> > >> >> replyItem Class groupofnames > >> >> replyItem Class group > >> >> > >> >> I think the above is correct. Can some shed some light on this? > >> > > >> >Is group and groupofnames something that is an attribute > >of a user? > >> >When freeradius searches for reply items it is searching for > >> >attributes of that user. > >> > > >> >eg: > >> > > >> >dn: cn=someuser,... > >> >group: somegroup > >> > > >> >Should then add > >> > > >> >Class = somegroup > >> > > >> >to the reply items. > >> > > >> >If you want to make reply items attached to a group, > >rather than in > >> >individual, you will need to set the User-Profile attribute. > >> > > >> >For example, > >> > > >> >dn: cn=somegroup,ou=groups,... > >> >group: somegroup > >> > > >> >Then in the users file. > >> > > >> >DEFAULT Ldap-Group == somegroup, User-Profile := > >> >"cn=somegroup,ou=groups,..." > >> > > >> >You may be able to do this dynamically using xlat or > >something like > >> >huntgroups too. If you want an example, send us an > >example of a user > >> >and group from AD in ldif format and an example of a > >radius packet > >> >that you would expect in the reply and I'll see if I can > >come up with > >> >an idea for ya. > >> > > >> > > >> > > >> >- > >> >List info/subscribe/unsubscribe? See > >> >http://www.freeradius.org/list/users.html > >> > > > > > > >Disclaimer: This message (including any attachments) is > >confidential, may be privileged and is only intended for the > >person to whom it is addressed. If you have received it by > >mistake please notify the sender by return e-mail and delete > >this message from your system. Any unauthorized use or > >dissemination of this message in whole or in part is > >strictly prohibited. E-mail communications are inherently > >vulnerable to interception by unauthorized parties and are > >susceptible to change. We will use alternate communication > >means upon request. > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Bohannan, Chad W 02 Dec '05

02 Dec '05

We were able to move past this particular problem. For anyone who may have a similar issue.... Port 512 (tcp&udp for EZEC service) need to be allowed in addition to the standard 137-139, 445, & 389. So if you are running TCP wrappers or ip tables make certain it is allowed.... cheers -----Original Message----- From: Bohannan, Chad W Sent: Thursday, December 01, 2005 11:27 AM To: 'charles schwartz'; 'FreeRadius users mailing list' Subject: RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial] Hello, I am attempting to have FR authenticate administrative access for my Cisco gear against AD. The problem I am having is this. When I attempt to join the realm <<net ads join -U UID>> the command appears successful and from the AD side, the system has joined (visable in AD), however the proccess hangs on the FR side. If I stop the process and reissue the command, I get the following output and the process again hangs: [2005/12/01 11:08:36, 0] libads/ldap.c:ads_add_machine_acct(1405) ads_add_machine_acct: Host account for rws-radius01 already exists - modifying old account <<ntlm_auth --request-nt-key --domain=mydomain --username= \myuid>> NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) <<wbinfo -a UID%PASSWD>> plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user UID%PASSWD with plaintext password challenge/response password authentication failed error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO Could not authenticate user UID with challenge/response I am sure there is something simple I have overlooked, but I am unable to find it at this point. Any suggestions would be much appreciated. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of charles schwartz Sent: Tuesday, November 22, 2005 11:28 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial] Hi list, A lot of people on this list would like to integrate Active Directory with FreeRADIUS in order to provide a transparent user authentication login process. There are at least 2 ways to integrate AD: LDAP and NTLM. I've written a tutorial about how to do this with NTLM (winbind, ntlm_auth). The Windows supplicants are configured to work with PEAP and MSCHAPv2. You can download it from here: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf Good luck! Regards, Charles Schwartz - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Freeradius How to integrate Active Directory and return group attribute to VPN Concentrator
by Alhagie Puye 02 Dec '05

02 Dec '05

> >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 30, 2005 7:16 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return group attribute to VPN Concentrator > > > >> Radiusd.conf: > >> > >> filter = > >> > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > >rOf=CN=rp > >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > >> > >> This works fine. However I can't get it to return any > >replyItems. Has > >> anyone gotten this to work with Active Directory? All the > >docs I see > >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > >folks out > >> there running Windows 2000/2003 Active Directory. > >> > >> I have spent a couple of days on this not having much > >luck. Here are a > >> few questions that would help me a bit. > >> > >> 1) Do I need groupname_attribute to get this to work? > >> > >> 2) What about groupmembership_filter and groupmembership_attribute? > >> > >> My ldap.attrmap looks like this: > >> > >> replyItem Class groupofnames > >> replyItem Class group > >> > >> I think the above is correct. Can some shed some light on this? > > > >Is group and groupofnames something that is an attribute of > >a user? When freeradius searches for reply items it is > >searching for attributes of that user. > > > >eg: > > > >dn: cn=someuser,... > >group: somegroup > > > >Should then add > > > >Class = somegroup > > > >to the reply items. > > > >If you want to make reply items attached to a group, rather > >than in individual, you will need to set the User-Profile attribute. > > > >For example, > > > >dn: cn=somegroup,ou=groups,... > >group: somegroup > > > >Then in the users file. > > > >DEFAULT Ldap-Group == somegroup, User-Profile := > >"cn=somegroup,ou=groups,..." > > > >You may be able to do this dynamically using xlat or > >something like huntgroups too. If you want an example, send > >us an example of a user and group from AD in ldif format and > >an example of a radius packet that you would expect in the > >reply and I'll see if I can come up with an idea for ya. I'm still waiting for some help with this.....I have sent all the information that you requested. I have gotten it to return the group name but it is also returning the username as well and the username is returned after the group name. Is there is way to return just the groupname? I really would like to resolve this issue ones and for all. I'm really surprised that there are not folks on the list who have Active Directory users that they want to use to lock VPN users into groups on the VPN Concentrator. If really there isn't, I would put a howto on this when I get it working and post it on the list. Here is my latest output: rlm_ldap: performing search in CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave, with filter (cn=itops) rlm_ldap::ldap_groupcmp: User found in group itops rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' radius_xlat: 'DC=corp,DC=van,DC=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter (&(sAMAccountName=apuye)(objectclass=user)) rlm_ldap: performing search in CN=itops,ou=Information Technology,ou=Datawave Users,dc=corp,dc=van,dc=dwave, with filter (objectclass=group) rlm_ldap: Adding samaccountname as Class, value itops & op=11 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding samaccountname as Class, value apuye & op=11 rlm_ldap: user apuye authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXXXXX" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 1 rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXXXX to huckster.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 4 to 10.99.1.50:1031 Class = 0x6170757965 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 4 with timestamp 438e98b2 Nothing to do. Sleeping until we see a request. Thanks, Alhagie. > > > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0