I am have profiles setup for all our users but I am having some trouble with the setting the groupmembership_filter correctly. It will query LDAP successfully but only after it does a failed search first.

I have tried using numerous filters including the default one but I cant seem to separate the username by itself which is causing the initial search failure. I read through the rlm_ldap doc a few times but I didn’t seem anything that I thought would help.

Here is the output from radius –X

This is the part where it uses the search filter and fails.

[files] users: Matched entry DEFAULT at line 214

  [domain1] Entering ldap_groupcmp()

[files]         expand: ou=radius,o=domain.on.ca,dc=placeholder,dc=ca -> ou=radius,o=domain.on.ca,dc=placeholder,dc=ca

[files]         expand: (&(objectClass=radiusProfile)(member=%{control:Ldap-UserDn})) -> (&(objectClass=radiusProfile)(member=uid\3d112boy\2cou\3dradius\2co\3ddomain.on.ca\2cdc\3dplaceholder\2cdc\3dca))

  [domain1] ldap_get_conn: Checking Id: 0

  [domain1] ldap_get_conn: Got Id: 0

  [domain1] performing search in ou=radius,o=domain.on.ca,dc=placeholder,dc=ca, with filter (&(cn=residential_profile)(&(objectClass=radiusProfile)(member=uid\3d112boy\2cou\3dradius\2co\3ddomain.on.ca\2cdc\3dplaceholder\2cdc\3dca)))

  [domain1] object not found

It starts a second search and succeeds.

  [domain1] ldap_release_conn: Release Id: 0

  [domain1] ldap_get_conn: Checking Id: 0

  [domain1] ldap_get_conn: Got Id: 0

  [domain1] performing search in uid=112boy,ou=radius,o=domain.on.ca,dc=palceholder,dc=ca, with filter (objectclass=*)

rlm_ldap::ldap_groupcmp: User found in group residential_profile

  [domain1] ldap_release_conn: Release Id: 0

[files] users: Matched entry DEFAULT at line 222

++[files] returns ok

My users file looks like this.

ldap domain1 {

        server = " ldap01.placeholder.ca"

        identity = "username xxx"

        password = xxxx

        basedn = "ou=radius,o=domain.on.ca,dc=placeholder,dc=ca"

        filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=posixAccount)(cn=true))"

        groupname_attribute = cn

        groupmembership_attribute = radiusGroupName

       groupmembership_filter = "(&(objectClass=radiusProfile)(member=%{control:Ldap-UserDn}))"

       #do_xlat = yes

       #compare_check_items = yes

       #access_attr_used_for_allow = yes

       ldap_connections_number = 5

My users file

DEFAULT Service-Type == Framed-User, Huntgroup-Name == bras, domain1-Ldap-Group == residential_profile

        Service-Type = Framed-User,

        Framed-Protocol = PPP,

        Cisco-AVPair += "ip:inacl#100=permit tcp any x.x.0.16 0.0.0.15 eq 25",

        Cisco-AVPair += "ip:inacl#200=deny tcp any any eq 25",

        Cisco-AVPair += "ip:inacl#300=permit ip any any",

        Fall-Through = No

Any help is apprecaited.

Thanks,

Chris