It does have a special meaning, but the method which FR is escaping the + character seems to have changed since version 3.0.4, and doesn't appear to be working (in my environment at least). If I run radtest against FRS-3.0.4 I get debug like this: (10356) Wed Nov Checking for suffix after "@" (10356) Wed Nov Looking up realm "vt.edu" for User-Name = "bob+ipad1@vt.edu" (10356) Wed Nov Found realm "vt.edu" (10356) Wed Nov Adding Stripped-User-Name = "bob+ipad1" (10356) Wed Nov Adding Realm = "vt.edu" (10356) Wed Nov Authentication realm is LOCAL (10356) Wed Nov 2 13:53:33 2016 : Debug: [suffix] = ok (10356) Wed NoNo EAP-Message, not doing EAP (10356) Wed Nov 2 13:53:33 2016 : Debug: [eap] = noop (10356) Wed NovEXPAND (&(uid=%{Stripped-User-Name})) (10356) Wed Nov --> (&(uid=bob\2bipad1)) (10356) Wed NovEXPAND ou=People,ou=NIS,o=vt (10356) Wed Nov --> ou=People,ou=NIS,o=vt (10356) Wed NovPerforming search in 'ou=People,ou=NIS,o=vt' with filter '(&(uid=bob\2bipad1))', scope 'sub' (10356) Wed NovWaiting for search result... (10356) Wed NovUser object found at DN "nuid=007,ou=Agents,ou=People,ou=NIS,o=vt" (10356) Wed NovProcessing user attributes And the corresponding OpenLDAP logs appear so: 2016-11-02T13:43:33.525988-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SRCH base="ou=People,ou=NIS,o=vt" scope=2 deref=0 filter="(&(uid=bob+ipad1))" 2016-11-02T13:43:33.526006-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SRCH attr=userPassword ntPassword prohibited 2016-11-02T13:43:33.526009-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SEARCH RESULT tag=101 err=0 nentries=1 text= Running it against FRS-3.0.11 I get debug like this: (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Checking for suffix after "@" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "bob+ipad1@vt.edu" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Found realm "~vt.edu$" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Adding Stripped-User-Name = "bob+ipad1" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Adding Realm = "vt.edu" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Authentication realm is LOCAL (7474379) Wed Nov 2 13:37:02 2016: Debug: [suffix] = ok (7474379) Wed Nov 2 13:37:02 2016: Debug: eap: No EAP-Message, not doing EAP (7474379) Wed Nov 2 13:37:02 2016: Debug: [eap] = noop (7474379) Wed Nov 2 13:37:02 2016: Debug: [files] = noop (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: --> (uid=bob\5c2bipad1) (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=bob\5c2bipad1)", scope "sub" (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Waiting for search result... (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Search returned no results (7474379) Wed Nov 2 13:37:02 2016: Debug: [ldap] = notfound And the corresponding OpenLDAP logs appear so: 2016-11-02T13:37:02.360308-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SRCH base="ou=People,ou=NIS,o=vt" scope=2 deref=0 filter="(uid=bob\5C2bipad1)" 2016-11-02T13:37:02.360550-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SRCH attr=userPassword ntPassword prohibited radiusControlAttribute radiusRequestAttribute radiusReplyAttribute 2016-11-02T13:37:02.360818-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SEARCH RESULT tag=101 err=0 nentries=0 text= <http://aka.ms/weboutlook> ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Tuesday, October 18, 2016 2:05 PM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11 On Oct 18, 2016, at 10:44 AM, Mark Williams <martialstudy@hotmail.com> wrote:
Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution?
The + character has special meaning in LDAP. As such, it's escaped. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html