Hi, I’m trying to set up Freeradius to use the LDAP module for the authorization and process authentication with MSCHAPv2. My goal is to assign vlans from some Organizational Units in AD. I wanted to use into the users files the argument “huntgroups” because it could check OU. Last time I tried MSCHAPv2 for both autz and auth with “ntlm_auth … --require-membership-of” but I could get only 2 vlans (depending is the user is in the group or not). So my question is it possible? And if yes, how to do that? Thanks, My files configuration files : - sites-enabled/default & inner-tunnel authorize { Autz-Type LDAP { ldap } .. ldap } authenticate { .. #Auth-Type LDAP { # ldap #} } - users DEFAULT Autz-Type := LDAP, Auth-Type := MSCHAP - eap.conf eap { default_eap_type = peap .. } peap { default_eap_type = mschapv2 .. } - modules/ldap ldap { server = "test.fr" identity = "cn=bindradius,cn=Users,dc=test,dc=fr" password = bindradius basedn = "cn=Users,dc=test,dc=fr" filter = "(samaccountname=%{User-Name})" .. } password_attribute = userPassword --------------------------------------------------------------------------------- Freeradius server log : --------------------------------------------------------------------------------- Wed Feb 18 11:11:28 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=7, length=202 Framed-MTU = 1480 NAS-IP-Address = 192.168.1.1 NAS-Identifier = "SWiTCH" User-Name = "philippe" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "17" Called-Station-Id = "00-13-21-a8-24-40" Calling-Station-Id = "00-15-c5-06-84-d8" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" EAP-Message = 0x0201000d017068696c69707065 Message-Authenticator = 0x5270b68813d479cb9e13dbb933792913 Wed Feb 18 11:11:39 2009 : Info: +- entering group authorize {...} Wed Feb 18 11:11:39 2009 : Info: ++[preprocess] returns ok Wed Feb 18 11:11:39 2009 : Info: ++[chap] returns noop Wed Feb 18 11:11:39 2009 : Info: ++[mschap] returns noop Wed Feb 18 11:11:39 2009 : Info: [suffix] No '@' in User-Name = "philippe", looking up realm NULL Wed Feb 18 11:11:39 2009 : Info: [suffix] No such realm "NULL" Wed Feb 18 11:11:39 2009 : Info: ++[suffix] returns noop Wed Feb 18 11:11:39 2009 : Info: [eap] EAP packet type response id 1 length 13 Wed Feb 18 11:11:39 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Feb 18 11:11:39 2009 : Info: ++[eap] returns updated Wed Feb 18 11:11:39 2009 : Info: ++[unix] returns notfound Wed Feb 18 11:11:39 2009 : Info: [files] users: Matched entry DEFAULT at line 1 Wed Feb 18 11:11:39 2009 : Info: ++[files] returns ok Wed Feb 18 11:11:39 2009 : Info: [ldap] performing user authorization for philippe Wed Feb 18 11:11:39 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Wed Feb 18 11:11:39 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: attempting LDAP reconnection Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: (re)connect to test.fr:389, authentication 0 Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: bind as cn=bindradius,cn=Users,dc=test,dc=fr/bindradius to test.fr:389 Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: waiting for bind result ... Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: Bind was successful Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Wed Feb 18 11:11:39 2009 : Info: [ldap] looking for check items in directory... Wed Feb 18 11:11:39 2009 : Info: [ldap] looking for reply items in directory... Wed Feb 18 11:11:39 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Wed Feb 18 11:11:39 2009 : Info: [ldap] user philippe authorized to use remote access Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Feb 18 11:11:39 2009 : Info: ++[ldap] returns ok Wed Feb 18 11:11:39 2009 : Info: ++[expiration] returns noop Wed Feb 18 11:11:39 2009 : Info: ++[logintime] returns noop Wed Feb 18 11:11:39 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Feb 18 11:11:39 2009 : Info: ++[pap] returns noop Wed Feb 18 11:11:39 2009 : Info: Using Autz-Type LDAP Wed Feb 18 11:11:39 2009 : Info: +- entering group LDAP {...} Wed Feb 18 11:11:39 2009 : Info: [ldap] performing user authorization for philippe Wed Feb 18 11:11:39 2009 : Info: [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=philippe) Wed Feb 18 11:11:39 2009 : Info: [ldap] expand: cn=Users,dc=test,dc=fr -> cn=Users,dc=test,dc=fr Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: performing search in cn=Users,dc=test,dc=fr, with filter (samaccountname=philippe) Wed Feb 18 11:11:39 2009 : Info: [ldap] looking for check items in directory... Wed Feb 18 11:11:39 2009 : Info: [ldap] looking for reply items in directory... Wed Feb 18 11:11:39 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Wed Feb 18 11:11:39 2009 : Info: [ldap] user philippe authorized to use remote access Wed Feb 18 11:11:39 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Feb 18 11:11:39 2009 : Info: ++[ldap] returns ok Wed Feb 18 11:11:39 2009 : Info: Found Auth-Type = MSCHAP Wed Feb 18 11:11:39 2009 : Info: +- entering group MS-CHAP {...} Wed Feb 18 11:11:39 2009 : Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Wed Feb 18 11:11:39 2009 : Info: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Wed Feb 18 11:11:39 2009 : Info: [mschap] No MS-CHAP-Challenge in the request Wed Feb 18 11:11:39 2009 : Info: ++[mschap] returns reject Wed Feb 18 11:11:39 2009 : Info: Failed to authenticate the user. Wed Feb 18 11:11:39 2009 : Info: Using Post-Auth-Type Reject Wed Feb 18 11:11:39 2009 : Info: +- entering group REJECT {...} Wed Feb 18 11:11:39 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> philippe Wed Feb 18 11:11:39 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Feb 18 11:11:39 2009 : Info: ++[attr_filter.access_reject] returns updated Wed Feb 18 11:11:39 2009 : Info: Delaying reject of request 0 for 1 seconds Wed Feb 18 11:11:39 2009 : Debug: Going to the next request Wed Feb 18 11:11:39 2009 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 1024, id=7, length=202 Wed Feb 18 11:11:40 2009 : Info: Waiting to send Access-Reject to client 192.168.1.1 port 1024 - ID: 7 Wed Feb 18 11:11:40 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 7 to 192.168.1.1 port 1024 Wed Feb 18 11:11:40 2009 : Debug: Waking up in 4.9 seconds. Wed Feb 18 11:11:45 2009 : Info: Cleaning up request 0 ID 7 with timestamp +11 Wed Feb 18 11:11:45 2009 : Debug: Ready to process requests. -- View this message in context: http://www.nabble.com/Autz-type-LDAP%2C-Auth-Type-MSCHAP-possible---%28for-v... Sent from the FreeRadius - User mailing list archive at Nabble.com.