Hi all, I have been roped in to look over an issue we have with migrating from Novell to AD. What we would like to do while we in the transitional phase is check both the AD and Novell LDAP services for authorisation and authentication (usernames are completely different so no need to be concerned with username clashes). I have managed to setup authentication fall through without any real issues, but, authorisation is having issues. Just to clarify, if I only specify one of the LDAP servers everything works like a treat, so the actual ldap server definitions are working fine in their own right. If I have the authorisation section setup: group LDAP { vudc01 { notfound=2 ok=return } novell { notfound=2 ok=return } } (I have also tried variations without the group LDAP line) Things eventually fail and the last useful message (I think) from -X -f is: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user It's not entirely clear what the freeradius LDAP module is doing BUT it would appear that it looks over both authorisation assertions and takes the one with least rights, but, I am not sure. As I stated earlier authentication fall through works like a treat (if in the users file I don't specify an LDAP-Group authentication works). If I only specify 1 ldap server to do authentication and authorisation, everything works, its only when I try to do authorisation via LDAP-Group AND try to do authorisation fall through as documentation above do I start getting errors. Can anyone offer any advice or pointers? Cheers, Stewart -X -f output: rad_recv: Access-Request packet from host 127.0.0.1:32909, id=60, length=60 User-Name = "USERNAME" User-Password = "PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "USERNAME", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=vu ' radius_xlat: '(uid=UID)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=vu, with filter (uid=USERNAME) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "files" returns notfound for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for USERNAME radius_xlat: '(samaccountname=USERNAME)' radius_xlat: 'dc=ad,dc=vu,dc=edu,dc=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ad,dc=vu,dc=edu,dc=au, with filter (samaccountname=USERNAME) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user USERNAME authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "vudc01" returns ok for request 1 modcall: leaving group redundant (returns ok) for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 60 to 127.0.0.1 port 32909 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 60 with timestamp 46c24e67 Nothing to do. Sleeping until we see a request.