On Aug 10, 2020, at 4:07 AM, Steve Phillips <steve@focb.co.nz> wrote:
Freeradius version: 3.0.13 (installed via rpm on rhel 7)
Updated RPMs are available at http://packages.networkradius.com
I have a reasonably simple (to my mind) setup that for some reason doesn’t seem to exist on the internet after much fruitless searching.
In essence, I am performing PAP auth to free radius which then binds as the user to AD via LDAP and performs an authentication
That's pretty common.
It then is supposed to return the groups the user is a member of and then I use the “files” directive to match a group and return a reply attribute
LDAP doesn't return the groups. You use "LDAP-Group = ..." to *match* a group. There's a difference.
I’m now busy pulling my hair out trying to work out how to debug what’s going on in the background, as I am having amazingly bad luck trying to work out how the group filter works (and yes, I did read the ldap module comments and couldn’t work anything out from this, or the rlm_ldap wiki)
The module now has some updated comments. It describes how to convert the ldap module configuration into ldapsearch parameters: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avail...
Running radiusd -X gives some information that it is attempting to check groups but claims the user is not a group member
Likely because the user is a member of a nested group. There's special LDAP magic to get AD to search nested groups. See the above link.
With some of these just hoping to get _anything_ to return (#groupmembership_filter = "(sAMAccountName=%{User-Name})")
It doesn't "return" the list of groups.
About the only thing I’ve had success in plugging into ldapsearch was the “(sAMAccountName=<my username>)” hence the attempt at doing that because it DID actually return “memberOf” attributes.
I guess what I’m trying to do, is work out what I am supposed to plug into ldap search as every time I try it returns nothing.
See the above link.
Is there a way to tell freeradius to print out what it thinks the various variables are? Like, %{Ldap-UserDN} I can see from the “sites-enabled” file as I can see it being set with..
Yes, just expand them, and the debug output will print their values; update control { Tmp-String-0 := "%{control:LDAP-UserDN}" }
Is there an easy to follow guide for ldapsearch that describes that the (|(&(<attribute>=<value>)(<attribute>=<value>))) bits even mean? (primarily the (|(&( bit, as I can do a single <attribute>=<value> Search and get that to work)
See the lapsearch documentation for documentation on how ldapsearch works. Alan DeKok.