note the "rlm_ldap: ldap_search() failed: Bad search filter" line

Thanks for pointing that out for me Alan, I missed that in the debug log.


Two main reasons: firstly, doing the LDAP lookups indirectly via rlm_unix is difficult to debug (as we are finding)

Secondly, doing the LDAP lookups directly gives you a more rich interface to the underlying LDAP data. Doing it via rlm_unix limits you to schema elements present in the posix LDAP schema and get*ent calls

Those both make perfect sense, thanks for explaining that Phil.


I finally got this working with the following groupmembership_filter...

"(&(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"


Thanks again to those who helped me with this, it's appreciated.


Regards
Cameron.
--







On Mon, Sep 27, 2010 at 22:44, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 27/09/10 11:44, Cameron Wood wrote:

   groupname_attribute = cn
   groupmembership_filter =
   "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=posixGroup)(memberUid=%{control:Ldap-UserDN}))"
   groupmembership_attribute = radiusGroupName


Attached is a debug log of my logon attempts with these settings, which
still fails unfortunately.

The filter is invalid. You're missing a trailing ")" which is easily done in the stupid LDAP filter syntax.




   If you can query LDAP directly, do so. Do not use rlm_unix for LDAP
   queries, even if nssswitch is setup for it.


Noted, are you able to elaborate on why this is the case though, just
like to understand, only if its not too much trouble though.

Two main reasons: firstly, doing the LDAP lookups indirectly via rlm_unix is difficult to debug (as we are finding).

Secondly, doing the LDAP lookups directly gives you a more rich interface to the underlying LDAP data. Doing it via rlm_unix limits you to schema elements present in the posix LDAP schema and get*ent calls.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html