Hi, I'm trying to set up 802.1x authentication on my Enterasys AccessPoints using freeradius and eDirectory. Freeradius and eDirectory work like a charm when I use it for Cisco-VPN authentication. This is the debug-output: rad_recv: Access-Request packet from host 10.3.4.10:1088, id=153, length=131 Message-Authenticator = 0x9243250f00d4eaf9edcbe955c5106fe5 User-Name = "dfuernsin" NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" EAP-Message = 0x0201000e0164667565726e73696e Framed-MTU = 1000 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,o=TGM/xxxxxxx to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Sending Access-Challenge of id 153 to 10.3.4.10 port 1088 Class = 0x54474d2d495453 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc467576a8938958c1a53a68b8e75ff64 rad_recv: Access-Request packet from host 10.3.4.10:1088, id=154, length=141 Message-Authenticator = 0x0967d369610e907bd46340a8497b3cd1 User-Name = "dfuernsin" State = 0xc467576a8938958c1a53a68b8e75ff64 NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 EAP-Message = 0x020200060315 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Sending Access-Challenge of id 154 to 10.3.4.10 port 1088 Class = 0x54474d2d495453 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc2b5e7347d4362c9837a8cdb5ae54cef rad_recv: Access-Request packet from host 10.3.4.10:1088, id=155, length=241 Message-Authenticator = 0xd03ac83eb22acb6875c887c94c819f4e User-Name = "dfuernsin" State = 0xc2b5e7347d4362c9837a8cdb5ae54cef NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 EAP-Message = 0x0203006a1500160301005f0100005b03014aa65ba4b109ea3853a601da56bcfb3503d5da3b5141d5ae1d46dc029a00009b00003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sending Access-Challenge of id 155 to 10.3.4.10 port 1088 Class = 0x54474d2d495453 EAP-Message = 0x010403e415c00000080c160301004a0200004603014aa65ba0b78781976e8fad382a31b4cbfac99b4a4b3bb7a15da50bb7a0cacbba205977e045237bf3b4079a8a6e0626197a60447cb1939ab691439bcbe1f82002b3003900160301069d0b0006990006960002cd308202c930820232a003020102020102300d06092a864886f70d010105050030819c310b3009060355040613024154310f300d060355040813065669656e6e61310f300d060355040713065669656e6e6131253023060355040a131c54474d202d2044696520536368756c652064657220546563686e696b310d300b060355040b130472616431311730150603550403130e54474d EAP-Message = 0x20436c69656e742053534c311c301a06092a864886f70d010901160d6974734074676d2e61632e6174301e170d3039303132363135303931395a170d3130303132363135303931395a30819e310b3009060355040613024154310f300d060355040813065669656e6e61310f300d060355040713065669656e6e6131253023060355040a131c54474d202d2044696520536368756c652064657220546563686e696b310d300b060355040b1304726164313119301706035504031310526f6f74206365727469666963617465311c301a06092a864886f70d010901160d6974734074676d2e61632e617430819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100afcebd714b483a8a5248285e080efc98c463327d4d76ba572326e4c585de64c946dcc1ac55b96f93542a67f546c6f29161b22b6152ef36ed6e17e50cac6f69cd3cfe791d39e10478e60e767ead1fe7af84a93c2143744ddb9efc3ceeeb6050f57f914ac3ed4ac32f59003a6661e9749e1a38846ed21b8015bad99935b8f774cf0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100c0c9edb6e0f7f54cdf49341bc3d31695b8a7318d1c7bc738ae316bcb4990842d5f034550ae6bc201220d38123e239cbfbb258b19e0b335461eb9e616c85402494ed2 EAP-Message = 0x38765b36ad92c6726e697e9232aa61aa3ee705521ccb59b91dbcf4475df14af87342965b0c58fe6dd3d8750193a4a91e964029b0ba452ee46d3be0a1d8af0003c3308203bf30820328a00302010202090090e75d8098036885300d06092a864886f70d010105050030819c310b3009060355040613024154310f300d060355040813065669656e6e61310f300d060355040713065669656e6e6131253023060355040a131c54474d202d2044696520536368756c652064657220546563686e696b310d300b060355040b130472616431311730150603550403130e54474d20436c69656e742053534c311c301a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x72e9a4df87e4335cee24c2dbc1c9dde3 rad_recv: Access-Request packet from host 10.3.4.10:1088, id=156, length=141 Message-Authenticator = 0xea43378afe10a29865cc0b2c502015c4 User-Name = "dfuernsin" State = 0x72e9a4df87e4335cee24c2dbc1c9dde3 NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 EAP-Message = 0x020400061500 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Sending Access-Challenge of id 156 to 10.3.4.10 port 1088 Class = 0x54474d2d495453 EAP-Message = 0x010503e415c00000080c06092a864886f70d010901160d6974734074676d2e61632e6174301e170d3039303132363135303931395a170d3131303132363135303931395a30819c310b3009060355040613024154310f300d060355040813065669656e6e61310f300d060355040713065669656e6e6131253023060355040a131c54474d202d2044696520536368756c652064657220546563686e696b310d300b060355040b130472616431311730150603550403130e54474d20436c69656e742053534c311c301a06092a864886f70d010901160d6974734074676d2e61632e617430819f300d06092a864886f70d010101050003818d0030818902 EAP-Message = 0x818100d1f5ae5fc44ca6966ed3217a38b384bce4c658868c6f8b7a1de9929348ba50c2070908a56f9c457532e6e83930ad12680ebd6494deda9215b1e401c1d9a2728782877d3bd20405861d8fafd07a79625db7c6ec0c526d5c76ada7a7f3b736c9afd4a59a78f4a3630006020208163418ecc5fbe40a3d2d6d6de4c962512548801b0203010001a382010530820101301d0603551d0e04160414b1f43b24b586334fa7c4d2a08bcc48f581e8f1fd3081d10603551d230481c93081c68014b1f43b24b586334fa7c4d2a08bcc48f581e8f1fda181a2a4819f30819c310b3009060355040613024154310f300d060355040813065669656e6e61310f30 EAP-Message = 0x0d060355040713065669656e6e6131253023060355040a131c54474d202d2044696520536368756c652064657220546563686e696b310d300b060355040b130472616431311730150603550403130e54474d20436c69656e742053534c311c301a06092a864886f70d010901160d6974734074676d2e61632e617482090090e75d8098036885300c0603551d13040530030101ff300d06092a864886f70d010105050003818100a93705a500a9f692697fbafd7a4380ac915c099012ad7e5b7fa81bcf88a194503a21d078015fdcc8b6002c7271e83185f5dd0a1930b833563f58721af1bab7d3a80f55e587a878f9efac9531cc56f6bce90c22ca458b EAP-Message = 0x950c0b8bd8f07773e654c74153aa54c20bfe9c0ec6c4330b00267c19cb777433bfabf26680f70f881972160301010d0c0001090040b0e40717d408c7bd95e486445a58ca90105eeb618a3cb101fedfa1f30852a72fb8585db5f4876611a2bdb3114e7806a3499aa7ab9fdaecd98b24b49dd737c7730001020040188269e7cb45c48d98c9afaf784b98f4097dc6cbacf7317ce7e57bc2dacae876e0a5d27d2accd4f5240e2228b99397b4d5cb25420942cbbdfc51b4e644cd3111008061c8942076db0af63f340a6e3658f5e512fcf58f5e087ef2f0619b78c225311d16046e6a769f383c23baadd1c35251c5b3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c3953fde1abb5c5aebec8ebfc86a1bb rad_recv: Access-Request packet from host 10.3.4.10:1088, id=157, length=141 Message-Authenticator = 0x3d7ea6f61b767389629d49596205cbd9 User-Name = "dfuernsin" State = 0x9c3953fde1abb5c5aebec8ebfc86a1bb NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 EAP-Message = 0x020500061500 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Sending Access-Challenge of id 157 to 10.3.4.10 port 1088 Class = 0x54474d2d495453 EAP-Message = 0x0106006215800000080c4735a6c865221013a00e96f493261b33521a8a8db63b2eeaa24bbd1fbbfc067771b65a0811beec00e57b7699eda4802ca8e81aabeca2dad6fd539cc217fb20f99d55eeb228d6da1110ae9c86e2f2f216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5661a0f5ce45e239b4bc70859f6a2bf9 rad_recv: Access-Request packet from host 10.3.4.10:1088, id=158, length=275 Message-Authenticator = 0x1b944ca85d6a4c92fa947f1637831748 User-Name = "dfuernsin" State = 0x5661a0f5ce45e239b4bc70859f6a2bf9 NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 EAP-Message = 0x0206008c150016030100461000004200403239103fe96393b4442f69821e1784ab56e448c25d9a02d3b76fd0201fc53bdf165556558f1539d40400185a164646a89aba0412c2e205ca7828ce2ba98b5aa114030100010116030100308b32065275900efdd52cf6124e1f032aca7d1f771bf611b925590b7412b935621bbd62f33a4bc4b97ee483a5a62e8dca rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sending Access-Challenge of id 158 to 10.3.4.10 port 1088 Class = 0x54474d2d495453 EAP-Message = 0x0107004515800000003b140301000101160301003040dc94e72be53bf55ddf8e541c965363d17b6a5afcd21214d85ead7b55840e0c48e144c6967f3431d935d8ea893dd23f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x37827b68d6e2834e52f9b31f421d6b57 rad_recv: Access-Request packet from host 10.3.4.10:1088, id=159, length=327 Message-Authenticator = 0xeaeace0d6f9aaa5a9b076145efdf883e User-Name = "dfuernsin" State = 0x37827b68d6e2834e52f9b31f421d6b57 NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 EAP-Message = 0x020700c015001703010020509e2651521db9d8f55ea9236544febdd1847d3d90824b31e7e4b065cce3be5f1703010090cd17c1519d0a3444677865909a065f47f58b4a429faa437acaefd64fcde712221684a961867da9ca7c65ac67c87a736bbd2ec83b4fa5620def3c9956dc47c89f0ba1cfc1119b276190b960dcc5feb1ab8ef37f84bfa605f215956585e7235faf28e1a5693cd43753121cebfbe74f628a8085c0844def4a1031da34e452d3cec56bf86dfdd77790388a97af5de4b1af82 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. TTLS: Got tunneled request User-Name = "dfuernsin" MS-CHAP-Challenge = 0x45343e241414cc6e2b419a80ca3c0679 MS-CHAP2-Response = 0xf90021c10a7e8786f207105e79fcf645fcea00000000000000000e9d76ed745951eb086371741cc54c64e7ec7e2ac6a29979 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "dfuernsin" MS-CHAP-Challenge = 0x45343e241414cc6e2b419a80ca3c0679 MS-CHAP2-Response = 0xf90021c10a7e8786f207105e79fcf645fcea00000000000000000e9d76ed745951eb086371741cc54c64e7ec7e2ac6a29979 FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 10.3.4.10 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00-1D-E0-64-67-4B" Called-Station-Id = "00-01-F4-1C-9B-89:TGM" Framed-MTU = 1000 rlm_ldap: - authorize rlm_ldap: performing user authorization for dfuernsin rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusClass as Class, value TGM-ITS & op=11 rlm_ldap: user dfuernsin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Login incorrect: [dfuernsin] (from client localhost port 2 cli 00-1D-E0-64-67-4B) TTLS: Got tunneled reply RADIUS code 3 Class = 0x54474d2d495453 MS-CHAP-Error = "\371E=691 R=1" Login incorrect: [dfuernsin] (from client management port 2 cli 00-1D-E0-64-67-4B) And here is my config: ldap { server = "localhost" identity = "cn=admin,o=TGM" password = xxxxxxx basedn = "o=TGM" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=tgmPerson)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = yes tls_cacertfile = /etc/raddb/certs/rootder.b64 # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=yes # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member= %{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember= %{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes } Can somebody help me? Thanks, Mike -- Please stop top-quoting! email: michi.fischer@gmx.net