Dear Bebbet, Are you familiar with ldap tools, such as ldapsearch etc? If yes, I would recommend to search your ``ldap'' server using these tools. Apply exactly the same base and filter, as you specified in your freeradius config. I would expect the same number of records. If not, then this weird and needs a deeper investigation. If yes, narrow down the number of records with your filter, till you get your desired result. Put this filter into the config file of freeradius. There is another interesting warning in the debug info: ``Performing unfiltered search in "", scope "sub"`` This needs a second thought as well. On Tue, May 17, 2016 at 03:38:47PM +0200, Bebbet van Dinges wrote:

Hello Willy,

Yes i gathered that much, only i'm not sure how to continue, i've tested quite some different possible filters, but all seem to do exactly the same, with the same 17** results.. Have i overlooked something?

Kind regards, Bebbet

On 17-5-2016 15:35, Willy Offermans wrote:

...

Dear Bebbet,

Your answer is already included in the debug information:

``specify a more restrictive base_dn, filter or scope''

Your ``ldap'' server returns more than 1 result upon request. This is not expected.

On Tue, May 17, 2016 at 03:20:12PM +0200, Bebbet van Dinges wrote:

...

Hello,

I'm trying to authorize/authenticate my wifi users against edirectory with Freeradius3, which doesn't work. It worked with this configuration in 2.2, but doesn't seem to provide the required result anymore.

I hope you can give me some pointers where to look next.

Yours sincerely, Bebbet

from raddebug:

(74) Tue May 17 12:19:27 2016: Debug: openldap: Performing unfiltered search in "", scope "sub" (74) Tue May 17 12:19:27 2016: Debug: openldap: Waiting for search result... (74) Tue May 17 12:19:30 2016: ERROR: openldap: Ambiguous search result, returned 1723 unsorted entries (should return 1 or 0). Enable sorting, or specify a more restrictive base_dn, filter or scope (74) Tue May 17 12:19:30 2016: ERROR: openldap: The following entries were returned:

[All the records in our directory\

/usr/loca/pf/raddb/modules-enabled/ldap:

ldap openldap { server = "dns3.desaad.nl" port = 636 identity = "cn=admin,o=desaad" password = "You wish.." basedn = "o=desaad" # filter = "(cn=%{mschap:User-Name})" filter ="(&(objectClass=inetOrgPerson)(uid=%{Stripped-User-Name:-%{User-Name}}))" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1

access_attr = cn password_attribute = nspmPassword

tls { start_tls = no require_cert = "allow" } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = yes

keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60

# LDAP_OPT_X_KEEPALIVE_PROBES probes = 3

# LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Met vriendelijke groeten, With kind regards, Mit freundlichen Gruessen, De jrus wah, Will ************************************* Powered by .... (__) \\\'',) \/ \ ^ .\._/_) www.FreeBSD.org

Hey Matthew, Thanks for your reply, i think it would've taken me a long time to figure this out myself! When i get back to work i'll go and try your suggestion. Thanks again, Bebbet On 17-5-2016 16:21, Matthew Newton wrote:

On Tue, May 17, 2016 at 03:20:12PM +0200, Bebbet van Dinges wrote:

...

I'm trying to authorize/authenticate my wifi users against edirectory with Freeradius3, which doesn't work. It worked with this configuration in 2.2, but doesn't seem to provide the required result anymore.

...

/usr/loca/pf/raddb/modules-enabled/ldap:

This is a v2 config. You need to edit the default v3 config and move the options over rather than just copy the v2 config in place. Many things have changed.

...

ldap openldap { server = "dns3.desaad.nl" port = 636 identity = "cn=admin,o=desaad" password = "You wish.." basedn = "o=desaad"

now base_dn, hence you're searching base ""

...

# filter = "(cn=%{mschap:User-Name})" filter ="(&(objectClass=inetOrgPerson)(uid=%{Stripped-User-Name:-%{User-Name}}))"

now goes in the user {} subsection.

Don't bother trying to update the config for v3, it will be more work than just configuring the default v3 config with your own values.

Matthew