Hi Jürgen, On Wed, 9 Jan 2019 at 11:42, Jürgen Northe <jn@northe-online.de> wrote:
Here the debug output and below a closer look at the ldap section with more verbosity.
You send an Access-Request with User-Name and User-Password (0) Received Access-Request Id 165 from 192.168.0.7:3437 to
192.168.0.215:1812 length 241 (0) User-Name = "106530670342" (0) User-Password = "106530670342"
You check the user but there's no password (0) redundant redundant_ldap {
rlm_ldap (ldap1): Reserved connection (0) (0) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap1: --> (cn=106530670342) (0) ldap1: Performing search in "dc=firma,dc=de" with filter "(cn=106530670342)", scope "sub" (0) ldap1: Waiting for search result... (0) ldap1: User object found at DN "cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=firma,dc=de" (0) ldap1: Processing user attributes (0) ldap1: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap1: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
So Access-Reject is sent
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject
(0) Sent Access-Reject Id 165 from 192.168.0.215:1812 to 192.168.0.7:3437 length 20
closer look...
Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Performing search in "dc=firma,dc=de" with filter "(cn=106530670342)", scope "sub" Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Waiting for search result... Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: User object found at DN "cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=firma,dc=de" Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Processing user attributes Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Attribute "userPassword" not found in LDAP object Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Attribute "radiusControlAttribute" not found in LDAP object Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Attribute "radiusRequestAttribute" not found in LDAP object Wed Jan 9 12:32:33 2019 : Debug: (0) ldap1: Attribute "radiusReplyAttribute" not found in LDAP object
Maybe you need to populate userPassword ? The attributes which where not found are not stored in the directory object
(laptop), thats true when I query with ldapsearch. Wed Jan 9 12:32:33 2019 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Wed Jan 9 12:32:33 2019 : Debug: (0) Post-Auth-Type REJECT { Wed Jan 9 12:32:33 2019 : Debug: (0) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Wed Jan 9 12:32:33 2019 : Debug: %{User-Name} Wed Jan 9 12:32:33 2019 : Debug: Parsed xlat tree: