unable to authenticate freeradius+AD
Hi all, I need your help to fix a problem in an AD configuration with Freeradius My platform : Freeradius + samba + AD ( windows 2003). The PB : unable to authenticate AD users This the debug of the authentication of an AD user on the server Regards. Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/>
SOS - is somebody around to HELP ME Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/> De : freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org [mailto:freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org] De la part de Yao Konou Envoyé : lundi 11 avril 2011 15:56 À : freeradius-users@lists.freeradius.org Objet : unable to authenticate freeradius+AD Hi all, I need your help to fix a problem in an AD configuration with Freeradius My platform : Freeradius + samba + AD ( windows 2003). The PB : unable to authenticate AD users This the debug of the authentication of an AD user on the server Regards. Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/>
You have not configured ntlm_auth, see http://deployingradius.com/documents/configuration/active_directory.html Von: freeradius-users-bounces+chris.schaatsbergen=aleo-solar.de@lists.freeradius.org [mailto:freeradius-users-bounces+chris.schaatsbergen=aleo-solar.de@lists.freeradius.org] Im Auftrag von Yao Konou Gesendet: Dienstag, 12. April 2011 15:53 An: FreeRadius users mailing list Betreff: RE: unable to authenticate freeradius+AD SOS - is somebody around to HELP ME Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/> De : freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org [mailto:freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org] De la part de Yao Konou Envoyé : lundi 11 avril 2011 15:56 À : freeradius-users@lists.freeradius.org Objet : unable to authenticate freeradius+AD Hi all, I need your help to fix a problem in an AD configuration with Freeradius My platform : Freeradius + samba + AD ( windows 2003). The PB : unable to authenticate AD users This the debug of the authentication of an AD user on the server Regards. Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/>
Hi Chris, and to all I have configurated the ntlm_auth as told here http://deployingradius.com/documents/configuration/active_directory.html and got success through all the step guide but when authenticate ntlm_auth and when put DEFAULT Auth-Type = ntlm_auth on the the top of /etc/freeradius /users no user can't authenticate, as you 'have suggested that the problem is ntlm_auth authentication. Can you guide on how fix it . This is a rar file with my user + ntlm_auth + mschap + site-enable/default conf. Thanks Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/> De : freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org [mailto:freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org] De la part de Schaatsbergen, Chris Envoyé : mardi 12 avril 2011 16:16 À : FreeRadius users mailing list Objet : AW: unable to authenticate freeradius+AD You have not configured ntlm_auth, see http://deployingradius.com/documents/configuration/active_directory.html Von: freeradius-users-bounces+chris.schaatsbergen=aleo-solar.de@lists.freeradius.org [mailto:freeradius-users-bounces+chris.schaatsbergen=aleo-solar.de@lists.freeradius.org] Im Auftrag von Yao Konou Gesendet: Dienstag, 12. April 2011 15:53 An: FreeRadius users mailing list Betreff: RE: unable to authenticate freeradius+AD SOS - is somebody around to HELP ME Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/> De : freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org [mailto:freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org] De la part de Yao Konou Envoyé : lundi 11 avril 2011 15:56 À : freeradius-users@lists.freeradius.org Objet : unable to authenticate freeradius+AD Hi all, I need your help to fix a problem in an AD configuration with Freeradius My platform : Freeradius + samba + AD ( windows 2003). The PB : unable to authenticate AD users This the debug of the authentication of an AD user on the server Regards. Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr<http://www.amr-services.fr/>
Hi , This my radius "radiusd -X" output Thanks Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr -----Message d'origine----- De : freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org [mailto:freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org] De la part de Alan Buxey Envoyé : mercredi 13 avril 2011 10:49 À : FreeRadius users mailing list Objet : Re: unable to authenticate freeradius+AD hi, dont really care about config - "radiusd -X" output please alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
hi, looks like PC not properly responding.... have you got the RADIUS server CA on the client? (ie does the client know the CA and trust it?) alan
Yes, The client is windows XP SP3 and I copied the certificate from the server to the client,installed it and configurated to use mschapV2. For information I can authenticate these users above: yao and Rgc but the members of LDAP groups "radius-users" can not #DEFAULT Auth-Type = ntlm_auth yao Cleartext-Password := "yao", MS-CHAP-Use-NTLM-Auth := 0 Reply-Message = "Felicitations vous venez de vous connecter au reseaux RGC", Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 2 rgc Cleartext-Password := "rgc", MS-CHAP-Use-NTLM-Auth := 0 Reply-Message = "Felicitations vous venez de vous connecter au reseaux RGC", Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 2 DEFAULT NAS-Port-Type == "Ethernet", Ldap-Group == "radius-users", Tunnel-Private-Group-Id == 2, Tunnel-Type == VLAN, Service-Type == Login-User, Tunnel-Medium-Type = IEEE-802, Fall-Through = no Thanks Yao Thierry Konou AMR SERVICES 11 Rue du Petit Châtelier CS90346 44303 NANTES CEDEX 3 Tel : 02 28 44 19 80 - Fax : 02 28 44 53 88 Site: http://www.amr-services.fr -----Message d'origine----- De : freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org [mailto:freeradius-users-bounces+ykonou=amr-services.com@lists.freeradius.org] De la part de Alan Buxey Envoyé : mercredi 13 avril 2011 11:12 À : FreeRadius users mailing list Objet : Re: unable to authenticate freeradius+AD hi, looks like PC not properly responding.... have you got the RADIUS server CA on the client? (ie does the client know the CA and trust it?) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yao Konou wrote:
Can you guide on how fix it .
Follow the documentation, including the documentation for what information to post to the list.
This is a rar file with my user + ntlm_auth + mschap + site-enable/default conf.
That information is probably useless. Post the debug output, as suggested in the FAQ, README, "man" page, web pages, and daily on this list. Alan DeKok.
participants (4)
-
Alan Buxey -
Alan DeKok -
Schaatsbergen, Chris -
Yao Konou