Logs
LDAP search fail, because LDAP-UserDN empty
Fri Nov  1 15:08:24 2013 : Info: +- entering group post-auth {...}
Fri Nov  1 15:08:24 2013 : Info: ++? if (LDAP-Group == "WIFI")
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: Entering ldap_groupcmp()
Fri Nov  1 15:08:24 2013 : Info:        expand: o=evrcargo -> o=evrcargo
Fri Nov  1 15:08:24 2013 : Info:        expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: performing search in o=evrcargo, with filter (&(cn=WIFI)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: object not found or got ambiguous search result
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: performing search in cn=Toomas,o=EVRCargo, with filter (objectclass=*)
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Fri Nov  1 15:08:24 2013 : Info: ++? elsif (LDAP-Group == "OPENVPN")
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: Entering ldap_groupcmp()
Fri Nov  1 15:08:24 2013 : Info:        expand: o=evrcargo -> o=evrcargo
Fri Nov  1 15:08:24 2013 : Info:        expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: performing search in o=evrcargo, with filter (&(cn=OPENVPN)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: object not found or got ambiguous search result
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: performing search in cn=Toomas,o=EVRCargo, with filter (objectclass=*)
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Fri Nov  1 15:08:24 2013 : Info: ++- entering else else {...}
Fri Nov  1 15:08:24 2013 : Info: +++[reject] returns reject
Fri Nov  1 15:08:24 2013 : Info: ++- else else returns reject
Fri Nov  1 15:08:24 2013 : Info: Using Post-Auth-Type Reject
Fri Nov  1 15:08:24 2013 : Info: +- entering group REJECT {...}

LDAP Bind

Fri Nov  1 15:08:24 2013 : Info: [ldap] performing user authorization for toomas
Fri Nov  1 15:08:24 2013 : Info: [ldap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details
Fri Nov  1 15:08:24 2013 : Info: [ldap]         expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=toomas)
Fri Nov  1 15:08:24 2013 : Info: [ldap]         expand: o=evrcargo -> o=evrcargo
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: attempting LDAP reconnection
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: (re)connect to 192.168.99.60:636, authentication 0
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: setting TLS mode to 1
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: setting TLS CACert File to /etc/raddb/certs/evrc-ou.pam
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: setting TLS Require Cert to demand
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: bind as cn=anz,o=evrcargo/whatis to 192.168.99.60:636
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: waiting for bind result ...
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: Bind was successful
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: performing search in o=evrcargo, with filter (uid=toomas)
Fri Nov  1 15:08:24 2013 : Info: [ldap] checking if remote access for toomas is allowed by rADIUSEnableDialAccess
Fri Nov  1 15:08:24 2013 : Info: [ldap] Added the eDirectory password XXXXXXXXXXXX in check items as Cleartext-Password
Fri Nov  1 15:08:24 2013 : Info: [ldap] No default NMAS login sequence
Fri Nov  1 15:08:24 2013 : Info: [ldap] looking for check items in directory...
Fri Nov  1 15:08:24 2013 : Info: [ldap] looking for reply items in directory...
Fri Nov  1 15:08:24 2013 : Info: [ldap] user toomas authorized to use remote access
Fri Nov  1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Fri Nov  1 15:08:24 2013 : Info: ++[ldap] returns ok



2013/11/1 Phil Mayers <p.mayers@imperial.ac.uk>
On 01/11/13 12:11, Andres Septer wrote:

       You need to read the documentation, and *understand* how FreeRADIUS
    works.  The alternative is random changes, confusion, upset users, and
    *more* work and pain.


Skipped the idea to use different LDAP attributes for WiFi and OpenVPN
altogether and turned to the LDAP groups.

But my Ldap-UserDn attribute wont get populated (even though user is
successfully authenticated in LDAP). So group search obviously fails

When I manually insert my test users DN, everything works as expected.

read the rlm_ldap manual but i still do not understand why my
LDAP-UserDn is not populated.

Sigh. Debug please, as gathered with "radiusd -X". We're not psychic.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html