2010/6/9 Alan DeKok <aland@deployingradius.com>
Nelson Vale wrote:
Sorry, the problem occurs only with the " (double quotes) character and not to the other two characters.
Try re-building from git.freeradius.org, branch v2.1.x. There's a fix which should help.
The user's DN is OK now (no extra characters), but the ldap authentication still doesn't work. I think the problem is that double quotes must be escaped before sent to AD.
In my fix in rlm_ldap (test purpose only), I did just that before assigning the vp_user_dn->vp_strvalue value to user_dn in ldap_authenticate() and it works OK. "... +- entering group LDAP {...} [ldap] login attempt by "xavez" with password "test123;" [ldap] user DN: CN=Carlos "xpto". Chavez,OU=students,DC=domain,DC=local [ldap] (re)connect to 192.168.0.73:389:389, authentication 1 [ldap] bind as CN=Carlos "xpto". Chavez,OU=students,DC=domain,DC=local/test123; to 192.168.0.73:389 :389 [ldap] waiting for bind result ... [ldap] Bind failed with invalid credentials ++[ldap] returns reject Failed to authenticate the user. ..." Escaping the double quotes: "... [ldap] login attempt by "xavez" with password "test123;" [ldap] user DN: CN=Carlos \"xpto\". Chavez,OU=students,DC=domain,DC=local [ldap] (re)connect to 192.168.0.73:389:389, authentication 1 [ldap] bind as CN=Carlos \"xpto\". Chavez,OU=students,DC=domain,DC=local/test123; to 192.168.0.73:389 :389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user xavez authenticated succesfully ++[ldap] returns ok ..."
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html