Good afternoon. I've been searching for an answer this issue on a new install of freeradius on CentOS 7, installed from RPMs. As far as I can see, what I enter for the ldap filter is not being used by the server, but I'm hopeful I've missed some detail in the configuration. Here' the key error in the output from radiusd -X. *(0) ERROR: ldap : (uid=%u)* *(0) ERROR: ldap : ^ Invalid variable expansion* *(0) ERROR: ldap : Unable to create filter* [root@kukulcan raddb]# grep -r '%u' [root@kukulcan raddb]# grep -r '\%u' [root@kukulcan raddb]# radiusd -v radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT [root@kukulcan raddb]# yum list freeradius\* Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: centos.host-engine.com * extras: centos.den.host-engine.com * updates: centos.mirror.ndchost.com Installed Packages freeradius.x86_64 3.0.4-6.el7 @base freeradius-devel.x86_64 3.0.4-6.el7 @base freeradius-doc.x86_64 3.0.4-6.el7 @base freeradius-krb5.x86_64 3.0.4-6.el7 @base freeradius-ldap.x86_64 3.0.4-6.el7 @base freeradius-mysql.x86_64 3.0.4-6.el7 @base freeradius-perl.x86_64 3.0.4-6.el7 @base freeradius-postgresql.x86_64 3.0.4-6.el7 @base freeradius-python.x86_64 3.0.4-6.el7 @base freeradius-sqlite.x86_64 3.0.4-6.el7 @base freeradius-unixODBC.x86_64 3.0.4-6.el7 @base freeradius-utils.x86_64 3.0.4-6.el7 @base Available Packages freeradius-devel.i686 3.0.4-6.el7 base /etc/raddb/mods-enables/ldap: [...] ldap { server = "ldap.eckerd.edu" identity = "cn=directory manager" password = ********* basedn = "dc=eckerd,dc=edu" * filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"* #base_filter = "(objectclass=radiusprofile)" [...] [root@kukulcan ~]# grep '%u' /etc/raddb/mods-enabled/ldap [root@kukulcan ~]# LDAP output from radiusd -X [...] # Loaded module rlm_ldap # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "ldap.eckerd.edu" port = 389 password = <<< secret >>> identity = "cn=directory manager" user { * filter = "(uid=%u)"* scope = "sub" base_dn = "" access_positive = yes } group { scope = "sub" base_dn = "" name_attribute = "cn" cacheable_name = no cacheable_dn = no } client { scope = "sub" base_dn = "" attribute { identifier = "host" shortname = "cn" } } profile { filter = "(&)" } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { start_tls = no } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful [...] Received Access-Request Id 44 from 127.0.0.1:44847 to 127.0.0.1:1812 length 77 User-Name = 'moorewr' User-Password = 'foobar' NAS-IP-Address = 198.187.214.151 NAS-Port = 0 Message-Authenticator = 0x6a42189a2e73e4a2d624012f4ab82ce3 (0) Received Access-Request packet from host 127.0.0.1 port 44847, id=44, length=77 (0) User-Name = 'moorewr' (0) User-Password = 'foobar' (0) NAS-IP-Address = 198.187.214.151 (0) NAS-Port = 0 (0) Message-Authenticator = 0x6a42189a2e73e4a2d624012f4ab82ce3 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { rlm_ldap (ldap): Reserved connection (4) *(0) ERROR: ldap : (uid=%u)* *(0) ERROR: ldap : ^ Invalid variable expansion* *(0) ERROR: ldap : Unable to create filter* rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" (0) [ldap] = invalid (0) } # authorize = invalid (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> moorewr (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 127.0.0.1 port 44847, id=44, length=0 Sending Access-Reject Id 44 from 127.0.0.1:1812 to 127.0.0.1:44847 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 44 with timestamp +259 -- +-----------------------------------------------------------------+ Walter R. Moore -- Sr. Systems Administrator, Eckerd College moorewr@eckerd.edu -- http://home.eckerd.edu/~moorewr "It was glorious to see -- if your heart were iron, And you could keep from grieving at all the pain" - The Iliad (13.355) I'm on twitter: http://twitter.com/moorewreckerd ***Reminder! ITS will never ask you to e-mail your password!***