Empty user attributes in proxied request
Hi Every body! I'm setting up an Eduroam infrastructure authenticating through a LDAP directory. I conveniently configure realms for local request and remote request as well. But, i'm dealing with empty user attribute issue while attempting to authenticate with the eduroam user. It seems that although the request is proxied, my server tries to locally check the authorized attributes of the user against my local ldap server. And since no such user exists ldap returns : object not found Thu Jan 5 20:19:26 2012 : Debug: rlm_ldap: object not found Thu Jan 5 20:19:26 2012 : Debug: search failed Thu Jan 5 20:19:26 2012 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Jan 5 20:19:26 2012 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Thu Jan 5 20:19:26 2012 : Debug: ++[ldap] returns notfound Next, my server proxies an other request with empty attributes certainly resulting from the previous object found result : Sending Access-Request of id 144 to 193.190.198.59 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Thu Jan 5 20:19:47 2012 : Debug: No response to status check 3 from home server 193.190.198.59 port 1812 What may have been misconfigured ? Note : The home server is alive since i test it through radtest command Please see here in attachment the log of user authentication attempt Thanks for your help. Eric ATTOU
Hi,
to authenticate with the eduroam user. It seems that although the request is proxied, my server tries to locally check the authorized attributes of the user against my local ldap server. And since no such user exists ldap returns : object not found
use unlang to put a protection wrapper around your ldap eg if (%{realm} == /yourrealm.com/){ ldap }
Next, my server proxies an other request with empty attributes certainly resulting from the previous object found result : Sending Access-Request of id 144 to 193.190.198.59 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?"
this is a status-check packet - your server is configured to sent status-check packets tothe remote proxy to check if its up/alive - there is no response to this request - so thats bad. you COULD configure proxy.conf for that remote proxy to use a username/pass (ideally a BAD password to get a REJECT) for this purpose if the remote proxy isnt responding to these packets as it should. for status requests a reject is as good as an accept...you get a response..thats what the server wants. you also then avoid leaking WORKING credentials into the system :-) alan
Attou eric wrote:
But, i'm dealing with empty user attribute issue while attempting to authenticate with the eduroam user. It seems that although the request is proxied, my server tries to locally check the authorized attributes of the user against my local ldap server. And since no such user exists ldap returns : object not found
Edit the configuration so it doesn't check LDAP for proxied packets. How are you proxying packets? What does the *rest* of the debug output look like?
Next, my server proxies an other request with empty attributes certainly resulting from the previous object found result :
No, and no. It's a status check packet, not a proxied packet. And it has nothing to do with the "object not found" error.
Sending Access-Request of id 144 to 193.190.198.59 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Thu Jan 5 20:19:47 2012 : Debug: No response to status check 3 from home server 193.190.198.59 port 1812
What may have been misconfigured ?
You set "username=" and "password=" in raddb/proxy.conf. Why? The comments documenting those configuration items describe what they do. It makes *no* sense to set them to be empty strings. In any case, I've committed a fix. The server now refuses to start if the username && password is misconfigured.
Note : The home server is alive since i test it through radtest command
<shrug> The error may have been transient. Alan DeKok.
participants (3)
-
Alan Buxey -
Alan DeKok -
Attou eric