Ldap group

9 Oct 2008

      Hello 

I have ldap working to authencate users to a cisci switch. I now want to
limit it to group membership. Any help would be great. 

Here is what I have in my ldap config for the groups. 

#  Group membership checking.  Disabled by default.
        #
         groupname_attribute = "cn"
         groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(object
Class=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
         groupmembership_attribute = "radius"

        #compare_check_items = yes
        # do_xlat = yes
        #access_attr_used_for_allow = yes

Here is waht I see in my logs with radiusd -X

Ready to process requests.
rad_recv: Access-Request packet from host 10.12.8.230 port 1645, id=35,
length=86
        User-Name = "bbeaudin"
        User-Password = "xxxxxxx^"
        NAS-Port = 194
        NAS-Port-Id = "tty194"
        NAS-Port-Type = Virtual
        Calling-Station-Id = "10.12.8.71"
        NAS-IP-Address = 10.12.8.230
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
    rlm_realm: No '@' in User-Name = "bbeaudin", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns updated
rlm_ldap: Entering ldap_groupcmp()
        expand: OU=Employees,DC=yipes,DC=com ->
OU=Employees,DC=yipes,DC=com
        expand: (&(samaccountname=%{user-name})) ->
(&(samaccountname=bbeaudin))
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to dendc1.yipes.com:389, authentication 0
rlm_ldap: bind as bbeaudin@yipes.com/xxxxxxxx to dendc1.yipes.com:389
rlm_ldap: waiting for bind result ...
request done: ld 0x121a6760 msgid 1
rlm_ldap: Bind was successful
rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter
(&(samaccountname=bbeaudin))
request done: ld 0x121a6760 msgid 2
rlm_ldap: ldap_release_conn: Release Id: 0
        expand:
(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectC
lass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) ->
(|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT
Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn
iqueNames)(uniquemember=)))
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in cn=radius,dc=yipes,dc=com, with filter
(|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT
Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn
iqueNames)(uniquemember=)))
request done: ld 0x121a6760 msgid 3
rlm_ldap: object not found or got ambiguous search result
rlm_ldap: ldap_release_conn: Release Id: 0
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in CN=Bert Beaudin,OU=IT
Staff,OU=Employees,DC=yipes,DC=com, with filter (objectclass=*)
request done: ld 0x121a6760 msgid 4
rlm_ldap::ldap_groupcmp: ldap_get_values() failed
rlm_ldap: ldap_release_conn: Release Id: 0
++[files] returns noop
rlm_ldap: - authorize
rlm_ldap: performing user authorization for bbeaudin
        expand: (&(samaccountname=%{user-name})) ->
(&(samaccountname=bbeaudin))
        expand: OU=Employees,DC=yipes,DC=com ->
OU=Employees,DC=yipes,DC=com
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter
(&(samaccountname=bbeaudin))
request done: ld 0x121a6760 msgid 5
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: Pairs do not match. Rejecting user.
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns reject
  Found Post-Auth-Type Reject
+- entering group REJECT
        expand: %{User-Name} -> bbeaudin
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Sending Access-Reject of id 35 to 10.12.8.230 port 1645
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 35 with timestamp +9
Ready to process requests.

Thanks,

Bert Beaudin
Systems Administrator
RelianceGlobalcom Services, Inc.
Office:303-785-6641
Cell:303-478-7789
Fax:415-677-9534
bbeaudin@relianceglobalcom.com <mailto:bbeaudin@relianceglobalcom.com> 
www.relianceglobalcom.com <blocked::http://www.yipes.com/>