Hi, I have several problems when I would like to link freeradius with AD using OpenLDAP. When I tried to test the binding of OpenLDAP to the AD with radtest, it responds Access-Accept (as you can see in the log after). But when I wanted to check with a real supplicant (under WinXP with MD5-Challenge Auth) I got an access-reject. Things I changed : - modules/ldap : ldap { server = "test.fr" identity = "cn=bindradius,cn=Users,dc=test,dc=fr" password = bindradius basedn = "cn=Users,dc=test,dc=fr" filter = "(samaccountname=%{User-Name})" .. } password_attribute = userPassword - site-enabled/default & inner-tunnel : authorize { .. # uncommented : ldap .. } authenticate { .. # uncommented : Auth-Type LDAP { ldap } Thanks for your help --------------------------------------------------------------------------------- Radtest : --------------------------------------------------------------------------------- root@freeradius:~# radtest philippe philippe localhost 0 testing123 Sending Access-Request of id 50 to 127.0.0.1 port 1812 User-Name = "philippe" User-Password = "philippe" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=50, length=20 --------------------------------------------------------------------------------- Freeradius log with radtest : --------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1 port 47525, id=50, length=60 User-Name = "philippe" User-Password = "philippe" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 [..] Tue Feb 17 15:38:25 2009 : Info: [ldap] performing user authorization for philippe Tue Feb 17 15:38:25 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Tue Feb 17 15:38:25 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: attempting LDAP reconnection Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 0 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: bind as cn=bindradius,cn=Users,dc=test,dc=fr/bindradius to test.fr:389 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: waiting for bind result ... Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: Bind was successful Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Tue Feb 17 15:38:25 2009 : Info: [ldap] looking for check items in directory... Tue Feb 17 15:38:25 2009 : Info: [ldap] looking for reply items in directory... Tue Feb 17 15:38:25 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Feb 17 15:38:25 2009 : Info: [ldap] user philippe authorized to use remote access Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Feb 17 15:38:25 2009 : Info: ++[ldap] returns ok [..] Tue Feb 17 15:38:25 2009 : Info: Found Auth-Type = LDAP Tue Feb 17 15:38:25 2009 : Info: +- entering group LDAP {...} Tue Feb 17 15:38:25 2009 : Info: [ldap] login attempt by "philippe" with password "philippe" Tue Feb 17 15:38:25 2009 : Info: [ldap] user DN: CN=philippe,CN=Users,DC=test,DC=fr Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 1 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: bind as CN=philippe,CN=Users,DC=test,DC=fr/philippe to test.fr:389 Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: waiting for bind result ... Tue Feb 17 15:38:25 2009 : Debug: rlm_ldap: Bind was successful Tue Feb 17 15:38:25 2009 : Info: [ldap] user philippe authenticated succesfully [..] Sending Access-Accept of id 50 to 127.0.0.1 port 47525 --------------------------------------------------------------------------------- With a real supplicant : --------------------------------------------------------------------------------- Tue Feb 17 15:40:50 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=5, length=202 Framed-MTU = 1480 NAS-IP-Address = 192.168.1.1 NAS-Identifier = "SWiTCH" User-Name = "philippe" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 21 NAS-Port-Type = Ethernet NAS-Port-Id = "21" Called-Station-Id = "00-13-21-a8-24-40" Calling-Station-Id = "00-15-c5-06-84-d8" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" EAP-Message = 0x0201000d017068696c69707065 Message-Authenticator = 0x2e787b9c5fea331ecfc02e8c3b85c55c Tue Feb 17 15:41:28 2009 : Info: +- entering group authorize {...} Tue Feb 17 15:41:28 2009 : Info: ++[preprocess] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[chap] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[mschap] returns noop Tue Feb 17 15:41:28 2009 : Info: [suffix] No '@' in User-Name = "philippe", looking up realm NULL Tue Feb 17 15:41:28 2009 : Info: [suffix] No such realm "NULL" Tue Feb 17 15:41:28 2009 : Info: ++[suffix] returns noop Tue Feb 17 15:41:28 2009 : Info: [eap] EAP packet type response id 1 length 13 Tue Feb 17 15:41:28 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns updated Tue Feb 17 15:41:28 2009 : Info: ++[unix] returns notfound Tue Feb 17 15:41:28 2009 : Info: [files] users: Matched entry DEFAULT at line 1 Tue Feb 17 15:41:28 2009 : Info: ++[files] returns ok Tue Feb 17 15:41:28 2009 : Info: [ldap] performing user authorization for philippe Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: attempting LDAP reconnection Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: bind as cn=bindradius,cn=Users,dc=test,dc=fr/bindradius to test.fr:389 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: waiting for bind result ... Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: Bind was successful Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for check items in directory... Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for reply items in directory... Tue Feb 17 15:41:28 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Feb 17 15:41:28 2009 : Info: [ldap] user philippe authorized to use remote access Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Feb 17 15:41:28 2009 : Info: ++[ldap] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[expiration] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[logintime] returns noop Tue Feb 17 15:41:28 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Feb 17 15:41:28 2009 : Info: ++[pap] returns noop Tue Feb 17 15:41:28 2009 : Info: Found Auth-Type = EAP Tue Feb 17 15:41:28 2009 : Info: +- entering group authenticate {...} Tue Feb 17 15:41:28 2009 : Info: [eap] EAP Identity Tue Feb 17 15:41:28 2009 : Info: [eap] processing type md5 Tue Feb 17 15:41:28 2009 : Debug: rlm_eap_md5: Issuing Challenge Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.1.1 port 1024 EAP-Message = 0x01020016041005f180280d72810cb4b1b9fa2033ede2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89d76e5089d56a6c48de80e818248c16 Tue Feb 17 15:41:28 2009 : Info: Finished request 0. Tue Feb 17 15:41:28 2009 : Debug: Going to the next request Tue Feb 17 15:41:28 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=6, length=237 Framed-MTU = 1480 NAS-IP-Address = 192.168.1.1 NAS-Identifier = "SWiTCH" User-Name = "philippe" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 21 NAS-Port-Type = Ethernet NAS-Port-Id = "21" Called-Station-Id = "00-13-21-a8-24-40" Calling-Station-Id = "00-15-c5-06-84-d8" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" State = 0x89d76e5089d56a6c48de80e818248c16 EAP-Message = 0x0202001e041046b39f2ac453deec1f14d2b599506e377068696c69707065 Message-Authenticator = 0x57f0fce82988e78eeb9bc719d015033d Tue Feb 17 15:41:28 2009 : Info: +- entering group authorize {...} Tue Feb 17 15:41:28 2009 : Info: ++[preprocess] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[chap] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[mschap] returns noop Tue Feb 17 15:41:28 2009 : Info: [suffix] No '@' in User-Name = "philippe", looking up realm NULL Tue Feb 17 15:41:28 2009 : Info: [suffix] No such realm "NULL" Tue Feb 17 15:41:28 2009 : Info: ++[suffix] returns noop Tue Feb 17 15:41:28 2009 : Info: [eap] EAP packet type response id 2 length 30 Tue Feb 17 15:41:28 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns updated Tue Feb 17 15:41:28 2009 : Info: ++[unix] returns notfound Tue Feb 17 15:41:28 2009 : Info: [files] users: Matched entry DEFAULT at line 1 Tue Feb 17 15:41:28 2009 : Info: ++[files] returns ok Tue Feb 17 15:41:28 2009 : Info: [ldap] performing user authorization for philippe Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for check items in directory... Tue Feb 17 15:41:28 2009 : Info: [ldap] looking for reply items in directory... Tue Feb 17 15:41:28 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Feb 17 15:41:28 2009 : Info: [ldap] user philippe authorized to use remote access Tue Feb 17 15:41:28 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Feb 17 15:41:28 2009 : Info: ++[ldap] returns ok Tue Feb 17 15:41:28 2009 : Info: ++[expiration] returns noop Tue Feb 17 15:41:28 2009 : Info: ++[logintime] returns noop Tue Feb 17 15:41:28 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Feb 17 15:41:28 2009 : Info: ++[pap] returns noop Tue Feb 17 15:41:28 2009 : Info: Found Auth-Type = EAP Tue Feb 17 15:41:28 2009 : Info: +- entering group authenticate {...} Tue Feb 17 15:41:28 2009 : Info: [eap] Request found, released from the list Tue Feb 17 15:41:28 2009 : Info: [eap] EAP/md5 Tue Feb 17 15:41:28 2009 : Info: [eap] processing type md5 Tue Feb 17 15:41:28 2009 : Debug: rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication Tue Feb 17 15:41:28 2009 : Info: [eap] Handler failed in EAP/md5 Tue Feb 17 15:41:28 2009 : Info: [eap] Failed in EAP select Tue Feb 17 15:41:28 2009 : Info: ++[eap] returns invalid Tue Feb 17 15:41:28 2009 : Info: Failed to authenticate the user. Tue Feb 17 15:41:28 2009 : Info: Using Post-Auth-Type Reject Tue Feb 17 15:41:28 2009 : Info: +- entering group REJECT {...} Tue Feb 17 15:41:28 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> philippe Tue Feb 17 15:41:28 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Feb 17 15:41:28 2009 : Info: ++[attr_filter.access_reject] returns updated Tue Feb 17 15:41:28 2009 : Info: Delaying reject of request 1 for 1 seconds Tue Feb 17 15:41:28 2009 : Debug: Going to the next request Tue Feb 17 15:41:28 2009 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=6, length=237 Tue Feb 17 15:41:29 2009 : Info: Waiting to send Access-Reject to client 192.168.1.1 port 1024 - ID: 6 Tue Feb 17 15:41:29 2009 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 6 to 192.168.1.1 port 1024 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Feb 17 15:41:29 2009 : Debug: Waking up in 3.9 seconds. Tue Feb 17 15:41:33 2009 : Info: Cleaning up request 0 ID 5 with timestamp +38 Tue Feb 17 15:41:33 2009 : Debug: Waking up in 0.9 seconds. Tue Feb 17 15:41:34 2009 : Info: Cleaning up request 1 ID 6 with timestamp +38 Tue Feb 17 15:41:34 2009 : Debug: Ready to process requests. -- View this message in context: http://www.nabble.com/Freeradius-with-OpenLDAP-and-AD.-tp22058186p22058186.h... Sent from the FreeRadius - User mailing list archive at Nabble.com.