Dear all, finally I have followed as you said: Authentication with samba, winbind, ntlm_auth and Authorization with LDAP, but I fails. I post my main config LDAP files and the debug output in order to get your help please: */etc/freeradius/modules/ldap:* ldap { server = "ldap.company.com" identity = "cn=connect,ou=users,dc=company,dc=com" password = 1234 basedn = "OU=users,DC=company,DC=com" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 max_uses = 0 port = 389 timeout = 4 timelimit = 3 net_timeout = 1 edir_account_policy_check = no groupmembership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes set_auth_type = no } */etc/freeradius/users:* DEFAULT Ldap-Group == "cn=group1,ou=wifi,dc=company,dc=com" Service-Type = Login-User DEFAULT Auth-Type := Reject */etc/freeradius/sites-available/default:* authorize { preprocess chap mschap digest suffix eap { ok = return } files *ldap* } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap ntlm_auth } */etc/freeradius/sites-available/inner-tunnel:* server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files * ldap* pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix ntlm_auth } After that I start "freeradius -XX" and execute: $ radtest adam 1234abcd 127.0.0.1 0 testing123 And I fail, this is the debug output: rad_recv: Access-Request packet from host 127.0.0.1 port 47637, id=109, length=79 User-Name = "adam" User-Password = "1234abcd" NAS-IP-Address = 10.10.10.1 NAS-Port = 0 Message-Authenticator = 0x817a524013d20e2d4f40cfbc99661b35 Tue Aug 15 12:38:27 2017 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Tue Aug 15 12:38:27 2017 : Info: +group authorize { Tue Aug 15 12:38:27 2017 : Info: ++[preprocess] = ok Tue Aug 15 12:38:27 2017 : Info: ++[chap] = noop Tue Aug 15 12:38:27 2017 : Info: ++[mschap] = noop Tue Aug 15 12:38:27 2017 : Info: ++[digest] = noop Tue Aug 15 12:38:27 2017 : Info: [suffix] No '@' in User-Name = "adam", looking up realm NULL Tue Aug 15 12:38:27 2017 : Info: [suffix] No such realm "NULL" Tue Aug 15 12:38:27 2017 : Info: ++[suffix] = noop Tue Aug 15 12:38:27 2017 : Info: [eap] No EAP-Message, not doing EAP Tue Aug 15 12:38:27 2017 : Info: ++[eap] = noop Tue Aug 15 12:38:27 2017 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 15 12:38:27 2017 : Info: [files] expand: OU= users,DC=company,DC=com -> OU=users,DC=company,DC=com Tue Aug 15 12:38:27 2017 : Info: [files] expand: %{Stripped-User-Name} -> Tue Aug 15 12:38:27 2017 : Info: [files] ... expanding second conditional Tue Aug 15 12:38:27 2017 : Info: [files] expand: %{User-Name} -> adam Tue Aug 15 12:38:27 2017 : Info: [files] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=adam) Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] attempting LDAP reconnection Tue Aug 15 12:38:27 2017 : Debug: [ldap] (re)connect to ldap.company.com:389, authentication 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] bind as cn=,ou=connect,ou=users,dc=company,dc=com/wP67yh345 to ldap.company.com:389 Tue Aug 15 12:38:27 2017 : Debug: [ldap] waiting for bind result ... Tue Aug 15 12:38:27 2017 : Debug: [ldap] Bind was successful Tue Aug 15 12:38:27 2017 : Debug: [ldap] performing search in OU=users,DC=company,DC=com, with filter (sAMAccountName=adam) Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 15 12:38:27 2017 : Info: [files] expand: (|(&(objectClass=group)(member=%{control:Ldap-UserDn}))) -> (|(&(objectClass=group)(member=CN\3dadam\OU\3dUsers\2cOU\DC\3dcompany\2cDC\3dcom))) Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] performing search in cn=group1,ou=wifi,dc=company,dc=com, with filter (|(&(objectClass=group)(member=CN\3dAdam\2cOU\3dUsers\2cDC\3dcompany\2cDC\3dcom))) Tue Aug 15 12:38:27 2017 : Debug: rlm_ldap::ldap_groupcmp: User found in group cn=group1,ou=wifi,dc=company,dc=com Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 15 12:38:27 2017 : Info: [files] users: Matched entry DEFAULT at line 207 Tue Aug 15 12:38:27 2017 : Info: ++[files] = ok Tue Aug 15 12:38:27 2017 : Info: [ldap] performing user authorization for adam Tue Aug 15 12:38:27 2017 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Aug 15 12:38:27 2017 : Info: [ldap] ... expanding second conditional Tue Aug 15 12:38:27 2017 : Info: [ldap] expand: %{User-Name} -> adam Tue Aug 15 12:38:27 2017 : Info: [ldap] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=adam) Tue Aug 15 12:38:27 2017 : Info: [ldap] expand: OU=users,DC=company,DC=com -> OU=users,DC=company,DC=com Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 15 12:38:27 2017 : Debug: [ldap] performing search in OU=users,DC=company,DC=com, with filter (sAMAccountName=adam) Tue Aug 15 12:38:27 2017 : Info: [ldap] No default NMAS login sequence Tue Aug 15 12:38:27 2017 : Info: [ldap] looking for check items in directory... Tue Aug 15 12:38:27 2017 : Info: [ldap] looking for reply items in directory... Tue Aug 15 12:38:27 2017 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Aug 15 12:38:27 2017 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 15 12:38:27 2017 : Info: ++[ldap] = ok Tue Aug 15 12:38:27 2017 : Info: ++[expiration] = noop Tue Aug 15 12:38:27 2017 : Info: ++[logintime] = noop Tue Aug 15 12:38:27 2017 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Aug 15 12:38:27 2017 : Info: ++[pap] = noop Tue Aug 15 12:38:27 2017 : Info: +} # group authorize = ok Tue Aug 15 12:38:27 2017 : Info: *ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user* Tue Aug 15 12:38:27 2017 : Info: Failed to authenticate the user. Tue Aug 15 12:38:27 2017 : Info: Using Post-Auth-Type REJECT Tue Aug 15 12:38:27 2017 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Tue Aug 15 12:38:27 2017 : Info: +group REJECT { Tue Aug 15 12:38:27 2017 : Info: [attr_filter.access_reject] expand: %{User-Name} -> adam Tue Aug 15 12:38:27 2017 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Aug 15 12:38:27 2017 : Info: ++[attr_filter.access_reject] = updated Tue Aug 15 12:38:27 2017 : Info: +} # group REJECT = updated Tue Aug 15 12:38:27 2017 : Info: Delaying reject of request 0 for 1 seconds Tue Aug 15 12:38:27 2017 : Debug: Going to the next request Tue Aug 15 12:38:27 2017 : Debug: Waking up in 0.9 seconds. Tue Aug 15 12:38:28 2017 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 109 to 127.0.0.1 port 47637 Tue Aug 15 12:38:28 2017 : Debug: Waking up in 4.9 seconds. Tue Aug 15 12:38:33 2017 : Info: Cleaning up request 0 ID 109 with timestamp +8 Tue Aug 15 12:38:33 2017 : Info: Ready to process requests Special thanks !!! ADAM 2017-08-15 10:02 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On Aug 15, 2017, at 2:49 PM, Adam Cage <adamcage27@gmail.com> wrote:
Dear Matthew and Alan, I take your advice and I will use my current succesful Freeradius platform for AUTHENTICATION (samba, winbind, ntlm_auth, mschapv2....according to Alan Dekok guide) and I will try to
use
LDAP for AUTHORIZATION as you said.
I'm listing my current Debian packages installed in my Freeradius server, and I see freeradius-ldap is not present:
freeradius 2.2.5+dfsg-0.2
That version is YEARS out of date.
Please install a recent version of the server. Packages for most common OS's are on http://packages.networkradius.com/
When I go to /etc/freeradius/modules I can see the ldap file, so is it necessary to install freeradius-ldap or not??? Because maybe it's sufficient to edit my current /etc/freeradius/modules/ldap file, I can't understand the sense of having freeradius-ldap package.
The freeradius-ldap package has the rlm_ldap library. The main package has the configuration files.
Think of it this way: if freereadius-ldap wasn't needed to do LDAP... then why would it exist?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html