These are the filters I'm using: filter in freeradius (work) = (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) filter in ldapsearch (work) = (sAMAccountName=rodrigoantunes) filter in freeradius (don't work) = (employeeID=%{mschap_default:User-Name:-%{User-Name}}) filter in ldap search (work) = (employeeID=1638828) The expanded filters in the logs are right, so I don't know why it isn't working; The FreeRADIUS version is 2.2.5. I know it is old, we are currently working on a new one, but we need to make this work until the new is ready. Citando Alan DeKok <aland@deployingradius.com>:
On Aug 7, 2023, at 10:01 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname.
This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}})
Now I need to enable the users to login with the employeeID.
This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})"
The filter works in ldapsearch but not in freeradius.
OK...
# Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail ... Why freeradius can't filter with the employeeID attribute?
It can. The filters you're giving to FreeRADIUS are different from the filters you're using in ldapsearch.
There are instructions in mods-available/ldap which say how to take the filters, etc. from the ldap module configuration, and then use them in ldapsearch. This lets you debug the exact parameters used by the server.
And which version are you running? That debug output looks very old. If you're running a version which is 5+ years old... please upgrade. It will be much better.
Alan DeKok.
-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html