Hi,
"resending this post as the previous post was of larger size and hence blocked"
When I configure the freeradius 2.1.12 with the following ldap config where base-dn does not have the "cn=Users" configured,
basedn = "dc=KC-DC-Solutions,dc=com" the authentication does not work fine with windows 2008 active directory.
The same works fine with a server configured on linux box with openldap.
The openldap is able to search the user and authentication goes fine
ldap ldap_primary {
server = 172.31.100.250
port = 389
identity = "cn=Administrator,cn=Users,dc=KC-DC-Solutions,dc=com"
password = "abcdefg"
basedn = "dc=KC-DC-Solutions,dc=com"
filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})"
start_tls = no
access_attr = "dialupacces"
dictionary_mapping = ${raddbdir}/ldap.attrma
With
windows AD the free radius fails in authenticating the client with the
reason " [ldap_primary] ldap_search() failed: Timed out while waiting
for server to respond. Please increase the timeout."
The below are the radiusd logs
[ldap_primary] rlm_ldap: performing user authorization for Kiran
[ldap_primary] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details
[ldap_primary] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=Kiran)
[ldap_primary] expand: dc=KC-DC-Solutions,dc=com -> dc=KC-DC-Solutions,dc=com
[ldap_primary] ldap_get_conn: Checking Id: 0
[ldap_primary] ldap_get_conn: Got Id: 0
[ldap_primary] attempting LDAP reconnection
[ldap_primary] (re)connect to
172.31.100.250:389, authentication 0
[ldap_primary] bind as cn=Administrator,cn=Users,dc=KC-DC-Solutions,dc=com/abcdefg to
172.31.100.250:389
[ldap_primary] waiting for bind result ...
[ldap_primary] Bind was successful
[ldap_primary] performing search in dc=KC-DC-Solutions,dc=com, with filter (sAMAccountName=Kiran)
[ldap_primary] ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout.
ldap server 172.31.100.250 is dead
[ldap_primary] attempting LDAP reconnection
[ldap_primary] closing existing LDAP connection
[ldap_primary] (re)connection attempt failed
[ldap_primary] search failed
[ldap_primary] ldap_release_conn: Release Id: 0
+++[ldap_primary] returns fail
++- policy redundant returns fail
Invalid user: [Kiran] (from client localhost port 1 cli 00-1E-E5-F9-BE-BC
When I configure the same with basedn = "cn=Users,dc=KC-DC-Solutions,dc=com", the ldap search works fine and authentication goes fine