On Tue, 2014-03-25 at 22:41 -0400, Alan DeKok wrote:
Brendan Kearney wrote:
Why? The "filter" configuration item is the *only* place where the LDAP "uid" search string is set. Editing anything else won't help. the uid vs dn may not be the issue (or at least not the only issue).
Pick one problem at a time and solve it. You said you wanted a search string which was more than "uid=...". I told you how to get that. Try it.
The problem will be fixed, and you can move on to the next problem. Or, you can ask for more help to solve the uid / filter problem.
You WILL NOT do anything useful by randomly switching between 5 separate issues. Only a consistent approach will fix anything. See "man radiusd" for more on this topic.
Read the documentation and configure it as required. i did and its vague.
The configuration items in raddb/modules/ldap are extensively documented. Do you have a SPECIFIC question? If so, why not ask it?
also its contradicted by what is on the freeradius site, which googling around turns up.
i.e. "stuff is wrong". WHAT is wrong? Where?
You're again being as vague as possible. This isn't helpful. your reputation for being *ahem* difficult precedes you, but i think it should be amened to include being a hypocrite, too. how does it feel? you have been nothing but obtuse and dodgy yourself.
You did post the debug output in your first message, which was nice:
Debug: [ldap] performing search in dc=bpk2,dc=com, with filter (uid=brendan)
You: the actual member "value" in the group is the "long" version of the uid (uid=brendan,ou=Users,dc=bpk2,dc=com). is there something i can do to use the "long" version?
Me: Edit the "filter" configuration in raddb/modules/ldap
You: It doesn't work.
Uh... that is a completely useless response. Yes, it does work. Many other people get LDAP filters working. They just edit the configuration item I said.
So... did you *try*? WHAT did you try? Is it a secret? Why didn't you post the debug output to the list?
where do i find the different variables that are referenced (Stripped-User-Name, User-Name, control:Ldap-UserDn, etc)?
Those are RADIUS attributes. Go to wiki.freeradius.org, and type "ldap" into the search box. Hit <enter>. Click on the first link. The LDAP-UserDn attribute is documented there. quoting:
For instance it can be set through the users file in the authorize section: ... well then, the authorize section has been moved out of the users file and into the modules/ldap file, AND IS NOT DOCUMENTED FURTHER. Moreover, my DN in LDAP is fully qualified: uid=brendan,ou=Users,dc=bpk2,dc=com. How you are determining the wrong value and populating a variable with that wrong value is a broken process. if a variable named Ldap-UserDn is going to be used, then the value of the DN in the tree is what i expect to find. what about you? i should not have to cobble together a value that claims to be collected already.
User-Name is a standard RADIUS attribute. Read the specs to see what it is. Really... we are NOT going to document every one of 8000 RADIUS attributes. That's ridiculous. why not? how are folks to know what they are? given the berating they get from the supposed help answering the mailing list, i doubt anyone would every really get answers if they had to find out something in particular. oh, and the attributes... the ones found here: http://freeradius.org/rfc/attributes.html THERE IS NOTHING ABOUT LDAP ANYTHING. disjointed documentation much? in fact it seems that most rlm_* attributes are not there at all. so, whats the deal with that? again, the users file references that, so why isnt it a complete reference?
Stripped-User-Name is ... the User-Name, stripped of a realm. Read the debug output to see what's going on.
where is the documentation around what %{%{Stripped-User-Name}:-%{User-Name}} does
$ man unlang
Which is referenced from the top comments on radiusd.conf.
vs %{%{control:Ldap-UserDn}:-%{control:Ldap-UserDn}} (which does not seem to work anyway)
If you had read the documentation, you'd understand that the above text makes zero sense. and thanks to the effort i have spent pulling your teeth, and rubbing your ego, i now have some place to turn for research. thanks. this could have been accomplished without you being a fuckchop 3 DAYS AGO.
And see the FAQ for "it doesn't work". Really.
yes, and a bunch of stuff is all that can be tried/done when no real, comprehensive howtos exist on how to do this.
Go to wiki.freeradius.org, and type "ldap" into the search box. Hit <enter>. Click on the first link.
http://www.clearfoundation.com/docs/howtos/setting_up_radius_to_use_ldap is the best i have found, and it does not work, is outdated or does not do everything i am looking for.
Yeah... third-party documentation that's 10 years old is preferable to reading the official FreeRADIUS Wiki, or the comments in the configuration files. well, if the info was not contradictory and was written to start at some point, provided clear steps to perform and ended with an accomplished goal, maybe 10 year old docs would not be better than the official wiki, but alas...
The FreeRADIUS documentation isn't perfect. But this is your third message complaining about it... with little to no content.
If all you say is "you guys suck", you won't solve the problem. isnt perfect? the technical writing is utter rubbish. example/correlation:
i took 4 years of spanish in school, and learned nothing but vocabulary and verb conjugation. i cant speak the language to save my life, and thats not for lack of effort. i have read docs, comments, wiki pages, mailing lists, etc and have some points that i know i can get to/through. but, in no way, shape or form can i call myself competent because no fundamental teachings exist on where to start, what to do and how to get to a specific configuration and successful implementation. at best a hodge-podge of hacked together directives are documented, isolated and atomically independent of any larger effort to be undertaken. i have been around the block. i support several technologies for a fortune 25 company. our golden rule is the "grandma" test. can the docs i put together for a process/effort/change be given to my grandmother and the work be done by her? take a starting point, perform deliberate steps (which include breakdowns of the commands with examples or the actual command to be run), achieve the desired result, and include a process to validate what is expected to be in place. my grandma + your docs != work getting done.
If you have *specific* and TECHNICAL questions, we can answer them. All it requires is for you to ask GOOD questions, with CONTENT.
It's up to you. Choose to ask useful questions, and you will get useful answers.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html