ok, in freeradius 2 i've used in post-auth if (LDAP-Group == "blabla") { ... } and all works fine but in freeradius 3?? i've tryed to set scope=base in ldap config and the result is (0) Waiting for search result... (0) Search returned no results The credentials are ok, can you tell me what mean "try using the global catalog server, instead of a local AD server" ?? if i perform a ldap search ldapsearch -h 10.0.0.19 -b "dc=intra,dc=ismaa,dc=it" -D "cn=squid,dc=intra,dc=ismaa,dc=it" -w "XXXXXXXX" '(&(objectCategory=person)(objectClass=user)(sAMAccountName=critest))' the result is: # extended LDIF # # LDAPv3 # base <dc=intra,dc=ismaa,dc=it> with scope subtree # filter: (&(objectCategory=person)(objectClass=user)(sAMAccountName=critest)) # requesting: ALL # # critest test, UO_Test2, Computers_SUS, intra.ismaa.it dn: CN=critest test,OU=UO_Test2,OU=Computers_SUS,DC=intra,DC=ismaa,DC=it objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: critest test sn: test givenName: critest distinguishedName: CN=critest test,OU=UO_Test2,OU=Computers_SUS,DC=intra,DC=is maa,DC=it instanceType: 4 whenCreated: 20130314153458.0Z whenChanged: 20131022132244.0Z displayName: critest test uSNCreated: 107373282 memberOf: CN=radius_cri,OU=RADIUS,OU=FEM,DC=intra,DC=ismaa,DC=it memberOf: CN=dipendenti,OU=Internet,DC=intra,DC=ismaa,DC=it memberOf: CN=K_Internet_Dipendenti,OU=Internet,DC=intra,DC=ismaa,DC=it uSNChanged: 358179580 name: critest test objectGUID:: JJ+bzzA9tEGdjQtyd8J8Kw== userAccountControl: 512 badPwdCount: 1 codePage: 0 countryCode: 0 homeDirectory: \\IASMA003\utenti\critest homeDrive: M: badPasswordTime: 130269164412391214 lastLogoff: 0 lastLogon: 130269081333443991 scriptPath: mainbatch.bat pwdLastSet: 130269217648210862 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAiqcyP6M80yZDFwoyPjAAAA== accountExpires: 0 logonCount: 95 sAMAccountName: critest division: 0da9ce1da208fc1751dcd52e479c6384869949f4 sAMAccountType: 805306368 userPrincipalName: critest@intra.ismaa.it lockoutTime: 0 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=intra,DC=ismaa,DC=it dSCorePropagationData: 20130411130311.0Z dSCorePropagationData: 20130411130311.0Z dSCorePropagationData: 20130411130311.0Z dSCorePropagationData: 16010108151056.0Z # search reference ref: ldap:// ForestDnsZones.intra.ismaa.it/DC=ForestDnsZones,DC=intra,DC=ismaa, DC=it # search reference ref: ldap:// DomainDnsZones.intra.ismaa.it/DC=DomainDnsZones,DC=intra,DC=ismaa, DC=it # search reference ref: ldap://intra.ismaa.it/CN=Configuration,DC=intra,DC=ismaa,DC=it # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 1 # numReferences: 3 surely the fault is mine, but I do not understand where it is... thank you!! 2013/10/25 Alan DeKok <aland@deployingradius.com>
Davide Garofalo wrote:
i've a big problem with the new module ldap.
It's a problem with active directory.
when i perform a ldap request i've this error Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Server said: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece.
That would seem to be obvious. Do you have it configured to use the correct credentials? Or, try using the global catalog server, instead of a local AD server.
You might not know this, but AD isn't really an LDAP server. It pretends to be one sometimes. But for critical issues... it's not.
DON'T do "-Xxxxxxx". It's pointless. "-X" is enough.
The debug log says:
Fri Oct 25 11:57:16 2013 : Info: Invalid operator for item Ldap-Group: reverting to '=='
Fix that. It won't solve the problem, but it will help.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*