rlm_ldap not populating Stripped-User-Name

3 Jan 2017

      Hi ,

   Just wondering if one of you could help me with a strange issue that
   has suddenly appeared.
   Freeradius Version: 3.0.11
   It looks like rlm_ldap has suddenly stopped picking up the
   Stripped-User-Name value, my config looks like bellow

    user {
           filter =
   "(samAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
           scope = "sub"
           base_dn = "dc=domain,dc=com"
           access_positive = yes
      }

   All was working fine with this server for a while. The same filter is
   working fine in other modules like mschap and ntlm_auth. The exapnsion
   of the filter returns no value for the Stripped-User-Name parameter.

   Here is the grepd version of radiusd -X

   Any points where I could start looking would be much appreciated as to
   why it suddenly stopped.
     # Loaded module rlm_ldap
     # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap
     ldap {
           server = "172.20.0.40"
           port = 389
           identity = "bindaccount"
           password = <<< secret >>>
      sasl {
      }
      user {
           scope = "sub"
           access_positive = yes
       sasl {
       }
      }
      group {
           scope = "base"
           name_attribute = "cn"
           membership_attribute = "memberOf"
           membership_filter =
   "(&(objectClass=group)(member=%{control:Ldap-UserDn}))"
           cacheable_name = yes
           cacheable_dn = yes
      }
      client {
           scope = "sub"
           base_dn = ""
      }
      profile {
      }
      options {
           ldap_debug = 0
           chase_referrals = no
           rebind = no
           net_timeout = 10
           res_timeout = 10
           srv_timelimit = 1
           idle = 60
           probes = 3
           interval = 3
      }
      tls {
           start_tls = no
      }
     }
   Creating attribute LDAP-Group
     # Loaded module rlm_mschap
     # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap
     mschap {
           use_mppe = yes
           require_encryption = yes
           require_strong = yes
           with_ntdomain_hack = no
           ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
   --username=%{%{Stripped-User-Name}:-%{User-Name}}
   --domain=%{%{mschap:NT-Domain}:-removed.com}
   --challenge=%{mschap:Challenge:-00}
   --nt-response=%{mschap:NT-Response:-00}"
      passchange {
      }
   --
     # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap
   rlm_ldap: libldap vendor: OpenLDAP, version: 20444
      accounting {
           reference = "%{tolower:type.%{Acct-Status-Type}}"
      }
      post-auth {
           reference = "."
      }
   rlm_ldap (ldap): Initialising connection pool
      pool {
           start = 5
           min = 3
           max = 10
           spare = 20
           uses = 0
           lifetime = 0
           cleanup_interval = 30
           idle_timeout = 0
           retry_delay = 30
           spread = no
      }

   Do let me know if you would like to see some additional configuration
   files.

   Many Thanks
   Arnab

rlm_ldap not populating Stripped-User-Name

Arnab Roy