I don't see any problem about ldap serach bind. The DN:cn=Administrator,cn=Users,dc=mydomain,dc=com, just as the name says, is the administrator user of mydomain.com and can search any other Organisation Unit of mydomain.com. All my users, except Administrator, are in the ou=drc,dc=mydomain,dc=com. Samba 4 domain works perfectly in Windows/Linux as in other system my company has. When I have tried to run radiusx -X with identity set in ldap module, the radiusd -X has informed rlm_ldap (ldap): Bind with cn=Administrator,cn=Users,dc=mydomain,dc=com to ldap://dc01.mydomain.com:389 failed: Strong(er) authentication required rlm_ldap (ldap): Server said: BindSimple: Transport encryption required. The employee who implemented Samba DC on my company has notified me he hasn't set ldap to run over ssl or start tls. Due it, I have tried to use SASL. It has worked fine when I have tried run a simple search using ldapsearch after kinit like this [root@centos8 ~]# kinit -a Administrator [root@centos8 ~]# ldapsearch -LLL -h dc01.mydomain.com -b "ou=drc,dc=mydomain,dc=com" sAMAccountName SASL/GSS-SPNEGO authentication started SASL username: Administrator@MYDOMAIN.COM SASL SSF: 256 SASL data security layer installed. <all users on ou=drc was shown> But it hasn't worked with freeradius ldap module. rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://dc01.mydomain.com:389 rlm_ldap (ldap): Starting SASL mech(s): GSSAPI SASL/GSSAPI authentication started rlm_ldap (ldap): Bind with (anonymous) to ldap://dc01.mydomain.com:389 failed: Local error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" PS: I've used freeradius from centos 8 repo, 3.0.16 version, and the host centos8 is a domain member on mydomain.com. -- Igor Sousa Em sáb., 22 de fev. de 2020 às 13:17, <uj2.hahn@posteo.de> escreveu:
rlm_ldap (ldap): Bind with *cn=Administrator,cn=Users,dc=mydomain,dc=com*
This doesn't match your ldap search binding:
"ou=drc,dc=mydomain,dc=com"
May be this is the issue? Please double check your ldap settings! Regards Uwe
On 21.02.2020 23:40, Igor Sousa wrote:
Hello everybody,
I have had some problems about to authorize users based on Active Directory (Samba 4 DCs) groups.
I have followed http://deployingradius.com/documents/configuration/active_directory.html to configure ntlm_auth and it works perfectly.
As I need restrict access to some AD groups, I need to configure ldap module. I've alright configured ldap module, but it has been pure Openldap (uid stores username and usePassword stores password). Then, to set up ldap module to access AD ldap, I've read comments on mods-available/ldap and I have set up "server", "identity", "password" and "base_dn" on the mods-enabled/ldap. I have also set up
to use the attribute stores username on AD user { ... filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" ... }
and
group { ... filter = '(objectClass=group)' ... name_attribute = cn
membership_filter =
"(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"
membership_attribute = 'memberOf' ... }
When I have tried to run radiusd -X, it has shown a error message about bind tried to ldap server:
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://dc01.mydomain.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind with cn=Administrator,cn=Users,dc=mydomain,dc=com
to
ldap://dc01.mydomain.com:389 failed: Strong(er) authentication required rlm_ldap (ldap): Server said: BindSimple: Transport encryption required.. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap"
I've suspected about SASL due I haven't been notify that LDAP use STARTTLS or SSL over TLS. Then I've commented identity and password and radiusd -X
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://dc01.mydomain.com:389 rlm_ldap (ldap): Starting SASL mech(s): GSSAPI SASL/GSSAPI authentication started rlm_ldap (ldap): Bind with (anonymous) to ldap://dc01.mydomain.com:389 failed: Local error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap"
I run kinit Administrator before run the ldapsearch below and hasn't shown any ERROR.
Please, can someone help me about my problem?
[root@centos8 ~]# ldapsearch -LLL -h dc01.mydomain.com -b "ou=drc,dc=mydomain,dc=com" sAMAccountName SASL/GSS-SPNEGO authentication started
SASL username: Administrator@MYDOMAIN.COM
SASL SSF: 256
SASL data security layer installed.
-- Igor Sousa - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html