Hi All, Guess I spoke to soon. I was using radtest and that worked great when I went to an actual workstation it was a different story. I am getting the old "[eap] Identity does not match User-Name, setting from EAP Identity." From reading through the archives it looks like this has been an issue in the past. So far it is mostly solved with the mschap call which I do not think will work with the .y2012 issue. I am still researching this part but if anyone has an ideas of where I may find a solution or an idea to fix it I would appreciate the short cut:) Thanks Brett Littrell Network Manager Milpitas Unified School District blittrell@musd.org Ph# (408)635-2600 X6086 Fax# (408)635-2632 CISSP, MCNE, CCVP, CCSP, Project+,MCITP/EA
On Friday, September 09, 2011 at 10:23 AM, in message <4E69E939020000690003F8E4@InternetEmail.musd.org>, "Brett Littrell" <Blittrell@musd.org> wrote:
Hi All, NM, you know I have been working on this for the last two days, I post here and no more the 30 minutes later I have a breakthrough.. Guess that is how it always works. Found a good ref on the FreeRadius site on the hints and started messing with that and came up with DEFAULT User-Name =~ "^([^.]+)", Strip-User-Name = yes User-Name := "%{1}" Thanks anyway!!.. Brett Littrell Network Manager Milpitas Unified School District blittrell@musd.org Ph# (408)635-2600 X6086 Fax# (408)635-2632 CISSP, MCNE, CCVP, CCSP, Project+,MCITP/EA
On Friday, September 09, 2011 at 9:22 AM, in message <4E69DAC9020000690003F8C5@InternetEmail.musd.org>, "Brett Littrell" <Blittrell@musd.org> wrote:
Hi All, I hate to post this here, I am sure there is a fairly simple thing to do this but I have been looking and can't seem to find how to do it. So we have users that typically login with a relative context. So there is a base context set to say ou=HS1.o=students, then they type in their name with a relative context, so it may be jsmith.y2012, with our network it sends to the server jsmith.y2012.hs1.students and logs in just fine. The problem we are having is that freeradius is getting the jsmith.y2012 as the username and trying to send that to ldap that first does not understand "." and second the ldap side is a flattened tree to speed up lookups so there is no sub-context. So the solution would seem to be to strip everything after the '.' so "jsmith.y2012" becomes just "jsmith". So I have been approaching it from this side and have tried using hints and attr_rewrite to do it. I am sure I missed something in each of them because it seems either should work, especially after reading a lot of the archived threads. So this is what I have done so far: created a "relative_username" module and placed it in /etc/raddb/modules directory. Contents are : attr_rewrite relative_username{ attribute = User-Name searchin = packet searchfor = ".y2012" replacewith = "" ignore_case = yes max_matches = 1 append = no } This is just for testing, I originally tried a regex expression of "searchfor =~ "^\w*" and "searchfor = "^\w*" but the unlang equal for regex poped with an error and the regual = I do not think recognized regex so I assumed that meant the regex was not supported in this module. Anyway, I have been testing the rewrite with a literal for a specific user to just see if it will work and does not seem to work. From here I call the relative_username in the /etc/raddb/sites_enabled/Radsite file in the Authorize section authorize { relative_username With this everything loads find and running radiusd -X I see that it is still trying to send the info to the LDAP server as jsmith.y2012 and of course it is failing. So on the hints side I was a little unsure of how it worked so I tried : DEFAULT User-Name =~ "^\w+" User-Name := "%{1}" That also did not seem to have an affect. So I am sure I am either barking up the wrong tree with both of these approaches or I am missing something in here. I should also mention, if I do not use the relative context the users authenticates just fine all is good in the world, it is just that darn trailing .y2012 that is the issue. Sorry ahead of time if this is really a stupid question, I am still learning freeradius (which I think is awesome)... So the debug log is below but it basically shows a object not found. rad_recv: Access-Request packet from host 10.2.2.100 port 36360, id=239, length=65 User-Name = "jsmith.y2012" User-Password = "123454" NAS-IP-Address = 10.2.2.100 NAS-Port = 1813 +- entering group authorize {...} [preprocess] expand: %{User-Name} -> jsmith.y2012 ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "jsmith.y2012", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jsmith.y2012 [ldap] expand: (cn=%{mschap:User-Name:-%{User-Name}}) -> (cn=jsmith.y2012) [ldap] expand: o=musd -> o=musd rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.###.###.###:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder2.b64 rlm_ldap: bind as cn=#######,ou=Radius,o=servers/######### to 10.###.###.###:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=musd, with filter (cn=jsmith.y2012) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jsmith.y2012 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 239 to 10.2.2.100 port 36360 Waking up in 4.9 seconds. Cleaning up request 0 ID 239 with timestamp +10 Ready to process requests. Brett Littrell Network Manager Milpitas Unified School District blittrell@musd.org Ph# (408)635-2600 X6086 Fax# (408)635-2632 CISSP, MCNE, CCVP, CCSP, Project+,MCITP/EA