note the "rlm_ldap: ldap_search() failed: Bad search filter" line
Thanks for pointing that out for me Alan, I missed that in the debug log. Two main reasons: firstly, doing the LDAP lookups indirectly via rlm_unix is
difficult to debug (as we are finding)
Secondly, doing the LDAP lookups directly gives you a more rich interface to the underlying LDAP data. Doing it via rlm_unix limits you to schema elements present in the posix LDAP schema and get*ent calls
Those both make perfect sense, thanks for explaining that Phil. I finally got this working with the following groupmembership_filter... "(&(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"
Thanks again to those who helped me with this, it's appreciated. Regards Cameron. -- On Mon, Sep 27, 2010 at 22:44, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 27/09/10 11:44, Cameron Wood wrote:
groupname_attribute = cn
groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=posixGroup)(memberUid=%{control:Ldap-UserDN}))" groupmembership_attribute = radiusGroupName
Attached is a debug log of my logon attempts with these settings, which still fails unfortunately.
The filter is invalid. You're missing a trailing ")" which is easily done in the stupid LDAP filter syntax.
If you can query LDAP directly, do so. Do not use rlm_unix for LDAP queries, even if nssswitch is setup for it.
Noted, are you able to elaborate on why this is the case though, just like to understand, only if its not too much trouble though.
Two main reasons: firstly, doing the LDAP lookups indirectly via rlm_unix is difficult to debug (as we are finding).
Secondly, doing the LDAP lookups directly gives you a more rich interface to the underlying LDAP data. Doing it via rlm_unix limits you to schema elements present in the posix LDAP schema and get*ent calls.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html