Hi Dominique There appears to be something wrong with the search base definition for your LDAP search. It looks like you are using the "traditional" LDAP basename which goes "ou=mydepartment, o=mycompany, c=ch". Active Directory uses basenames that look like "dc=ad, dc=ch". Your LDAP server is returning "operations error", so I should look in its log file for more details. By the way, bear in mind that unless you use Microsoft IAS, you can only do RADIUS authentication against AD using PAP (i.e. users send passwords in cleartext), which isn't too secure. Max Caines
-----Original Message----- From: freeradius-users-bounces+max.caines=wlv.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+max.caines=wlv.ac.uk@lists.fr eeradius.o rg]On Behalf Of domjullier@rhone.ch Sent: 03 April 2006 10:27 To: freeradius-users@lists.freeradius.org Subject: Problem with LDAP against Active Directory
Hi folks, I want authenticate users from a WLAN with freeradius. The Users are stored in the Active Directory of a Windows 2003 Server.
With some Tutorials from the Internet I have configured freeradius to make that.
Unfortunately the Authentication function not succesfully.
Thats the output from FreeRadius during the Authentication:
rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 NAS-Port-Type = Ethernet Service-Type = Login-User User-Name = "ldap" User-Password = "ldap" Called-Station-Id = "00:01:02:ad:64:f7" Calling-Station-Id = "00:c0:49:54:b5:43" NAS-Port = 1 Mon Apr 3 11:12:08 2006 : Debug: Processing the authorize section of radiusd.conf Mon Apr 3 11:12:08 2006 : Debug: modcall: entering group authorize for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No '@' in User-Name = "ldap", looking up realm NULL Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No such realm "NULL" Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: - authorize Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: performing user authorization for ldap Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: '(uid=ldap)' Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: 'ou=Sion, o=ad.ch' Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: attempting LDAP reconnection Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: closing existing LDAP connection Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: (re)connect to ad.ch:389, authentication 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: bind as / to ad.ch:389 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: Bind was successful Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing search in ou=Sion, o=ad.ch, with filter (uid=ldap) Mon Apr 3 11:12:18 2006 : Error: rlm_ldap: ldap_search() failed: Operations error Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: search failed Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "ldap" returns fail for request 2 Mon Apr 3 11:12:18 2006 : Debug: modcall: group authorize returns fail for request 2 Mon Apr 3 11:12:18 2006 : Debug: Finished request 2 Mon Apr 3 11:12:18 2006 : Debug: Going to the next request Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:18 2006 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 Mon Apr 3 11:12:18 2006 : Debug: Discarding duplicate request from client testnet:4596 - ID: 13 Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:18 2006 : Debug: Cleaning up request 2 ID 13 with timestamp 4430e6e8 Mon Apr 3 11:12:18 2006 : Debug: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 NAS-Port-Type = Ethernet Service-Type = Login-User User-Name = "ldap" User-Password = "ldap" Called-Station-Id = "00:01:02:ad:64:f7" Calling-Station-Id = "00:c0:49:54:b5:43" NAS-Port = 1 Mon Apr 3 11:12:18 2006 : Debug: Processing the authorize section of radiusd.conf Mon Apr 3 11:12:18 2006 : Debug: modcall: entering group authorize for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No '@' in User-Name = "ldap", looking up realm NULL Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No such realm "NULL" Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: - authorize Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing user authorization for ldap Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: '(uid=ldap)' Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: 'ou=Sion, o=ad.ch' Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: attempting LDAP reconnection Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: closing existing LDAP connection Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: (re)connect to ad.ch:389, authentication 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: bind as / to ad.ch:389 Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: Bind was successful Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: performing search in ou=Sion, o=ad.ch, with filter (uid=ldap) Mon Apr 3 11:12:28 2006 : Error: rlm_ldap: ldap_search() failed: Operations error Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: search failed Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Apr 3 11:12:28 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 3 Mon Apr 3 11:12:28 2006 : Debug: modcall[authorize]: module "ldap" returns fail for request 3 Mon Apr 3 11:12:28 2006 : Debug: modcall: group authorize returns fail for request 3 Mon Apr 3 11:12:28 2006 : Debug: Finished request 3 Mon Apr 3 11:12:28 2006 : Debug: Going to the next request Mon Apr 3 11:12:28 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:28 2006 : Debug: Waking up in 6 seconds... Mon Apr 3 11:12:34 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:34 2006 : Debug: Cleaning up request 3 ID 13 with timestamp 4430e6f2 Mon Apr 3 11:12:34 2006 : Debug: Nothing to do. Sleeping until we see a request.
Where can I fix the misstake which produce this error?
greets
dominique
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html