Hey, thanks for the help.
yeah, this part seems to be ok, the second part i wrongly quoted
if i undertood this, freeradius can authorizate but no authenticate, look the full result of freeradius -X
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
[ldap] performing user authorization for user1
[ldap] expand: (uid=%u) -> (uid=user1)
[ldap] expand: dc=xxxx,dc=edu,dc=br -> dc=ifsudeste,dc=edu,dc=br
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] attempting LDAP reconnection
[ldap] (re)connect to 200.xx.xx.47:389, authentication 0
[ldap] bind as cn=admin,dc=xxxx,dc=edu,dc=br/123abc to 200.xxx.xx.47:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
here he makes the bind and return ok, right?
[ldap] performing search in dc=xxxx,dc=edu,dc=br, with filter (uid=user1) <-------- now he try to find user1 on LDAP base.
[ldap] checking if remote access for user1 is allowed by uid
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] userPassword -> Password-With-Header == "{MD5}ICy5YqxZB1uWSwcVLSNLcA=="
[ldap] looking for reply items in directory...
[ldap] Setting Auth-Type = LDAP
[ldap] user user1 authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok <---- so far... everything ok
++[expiration] returns noop
++[logintime] returns noop
now he do that and i dont know why correctly, but i guess now he try to authenticate, am i right?
Found Auth-Type = LDAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group LDAP {...}
[ldap] login attempt by "user1" with password "123"
[ldap] user DN: cn=user1,ou=People,dc=xxxxxxx,dc=edu,dc=br <--------------- here he try to bind again!?
[ldap] (re)connect to 200.xxx.xxx.47:389, authentication 1
[ldap] bind as cn=user1,ou=People,dc=xxxxxxx,dc=edu,dc=br/123 to 200.xxx.xx.47:389 <----- and seems to try to use user1 to bind, but user 1 isn't a bind user
[ldap] waiting for bind result ...
[ldap] Bind failed with invalid credentials <---------- This is what i'm complaining.
++[ldap] returns reject
Failed to authenticate the user.
Login incorrect ( [ldap] Bind as user failed): [user1/123] (from client localhost port 10)
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> user1
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
and the result of radtest is:
radtest user1
123 127.0.0.1 10 testing123
Sending Access-Request of id 156 to 127.0.0.1 port 1812
User-Name = "user1"
User-Password = "123"
NAS-IP-Address = 200.131.96.47
NAS-Port = 10
rad_recv:
Access-Reject packet from host 127.0.0.1 port 1812, id=156, length=20
any idea why?