hi all, i've a big problem with the new module ldap. when i perform a ldap request i've this error Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Server said: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece. Here <https://dl.dropboxusercontent.com/u/15956439/radius3/default> you can find my sites default configuration here <https://dl.dropboxusercontent.com/u/15956439/radius3/ldap> you can find my ldap module configuration here <https://dl.dropboxusercontent.com/u/15956439/radius3/debug> you can find the full debug output and here <https://dl.dropboxusercontent.com/u/15956439/radius3/scan> a trace that you can open with wireshark Where i wrong??? Thank you -- *Davide Garofalo*
On Fri, Oct 25, 2013 at 02:26:52PM +0200, Davide Garofalo wrote:
Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. ... Where i wrong???
My guess is that you have tried to use your 2.x configuration, rather than rebuild based off the 3.x default config as the release notes make clear. These options have moved. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Davide Garofalo wrote:
i've a big problem with the new module ldap.
It's a problem with active directory.
when i perform a ldap request i've this error Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Server said: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece.
That would seem to be obvious. Do you have it configured to use the correct credentials? Or, try using the global catalog server, instead of a local AD server. You might not know this, but AD isn't really an LDAP server. It pretends to be one sometimes. But for critical issues... it's not. DON'T do "-Xxxxxxx". It's pointless. "-X" is enough. The debug log says:
Fri Oct 25 11:57:16 2013 : Info: Invalid operator for item Ldap-Group: reverting to '=='
Fix that. It won't solve the problem, but it will help. Alan DeKok.
ok, in freeradius 2 i've used in post-auth if (LDAP-Group == "blabla") { ... } and all works fine but in freeradius 3?? i've tryed to set scope=base in ldap config and the result is (0) Waiting for search result... (0) Search returned no results The credentials are ok, can you tell me what mean "try using the global catalog server, instead of a local AD server" ?? if i perform a ldap search ldapsearch -h 10.0.0.19 -b "dc=intra,dc=ismaa,dc=it" -D "cn=squid,dc=intra,dc=ismaa,dc=it" -w "XXXXXXXX" '(&(objectCategory=person)(objectClass=user)(sAMAccountName=critest))' the result is: # extended LDIF # # LDAPv3 # base <dc=intra,dc=ismaa,dc=it> with scope subtree # filter: (&(objectCategory=person)(objectClass=user)(sAMAccountName=critest)) # requesting: ALL # # critest test, UO_Test2, Computers_SUS, intra.ismaa.it dn: CN=critest test,OU=UO_Test2,OU=Computers_SUS,DC=intra,DC=ismaa,DC=it objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: critest test sn: test givenName: critest distinguishedName: CN=critest test,OU=UO_Test2,OU=Computers_SUS,DC=intra,DC=is maa,DC=it instanceType: 4 whenCreated: 20130314153458.0Z whenChanged: 20131022132244.0Z displayName: critest test uSNCreated: 107373282 memberOf: CN=radius_cri,OU=RADIUS,OU=FEM,DC=intra,DC=ismaa,DC=it memberOf: CN=dipendenti,OU=Internet,DC=intra,DC=ismaa,DC=it memberOf: CN=K_Internet_Dipendenti,OU=Internet,DC=intra,DC=ismaa,DC=it uSNChanged: 358179580 name: critest test objectGUID:: JJ+bzzA9tEGdjQtyd8J8Kw== userAccountControl: 512 badPwdCount: 1 codePage: 0 countryCode: 0 homeDirectory: \\IASMA003\utenti\critest homeDrive: M: badPasswordTime: 130269164412391214 lastLogoff: 0 lastLogon: 130269081333443991 scriptPath: mainbatch.bat pwdLastSet: 130269217648210862 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAiqcyP6M80yZDFwoyPjAAAA== accountExpires: 0 logonCount: 95 sAMAccountName: critest division: 0da9ce1da208fc1751dcd52e479c6384869949f4 sAMAccountType: 805306368 userPrincipalName: critest@intra.ismaa.it lockoutTime: 0 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=intra,DC=ismaa,DC=it dSCorePropagationData: 20130411130311.0Z dSCorePropagationData: 20130411130311.0Z dSCorePropagationData: 20130411130311.0Z dSCorePropagationData: 16010108151056.0Z # search reference ref: ldap:// ForestDnsZones.intra.ismaa.it/DC=ForestDnsZones,DC=intra,DC=ismaa, DC=it # search reference ref: ldap:// DomainDnsZones.intra.ismaa.it/DC=DomainDnsZones,DC=intra,DC=ismaa, DC=it # search reference ref: ldap://intra.ismaa.it/CN=Configuration,DC=intra,DC=ismaa,DC=it # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 1 # numReferences: 3 surely the fault is mine, but I do not understand where it is... thank you!! 2013/10/25 Alan DeKok <aland@deployingradius.com>
Davide Garofalo wrote:
i've a big problem with the new module ldap.
It's a problem with active directory.
when i perform a ldap request i've this error Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Server said: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece.
That would seem to be obvious. Do you have it configured to use the correct credentials? Or, try using the global catalog server, instead of a local AD server.
You might not know this, but AD isn't really an LDAP server. It pretends to be one sometimes. But for critical issues... it's not.
DON'T do "-Xxxxxxx". It's pointless. "-X" is enough.
The debug log says:
Fri Oct 25 11:57:16 2013 : Info: Invalid operator for item Ldap-Group: reverting to '=='
Fix that. It won't solve the problem, but it will help.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
On 25 Oct 2013, at 14:07, Davide Garofalo <davide.garofalo@gmail.com> wrote:
ok, in freeradius 2 i've used in post-auth if (LDAP-Group == "blabla") { ... } and all works fine but in freeradius 3??
https://github.com/FreeRADIUS/freeradius-server/tree/master/raddb#rlm_ldapld... Are you using a non default instance? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
No copy and paste of configuration, is a fresh install e the site-enable/default is the original file. I've read the README.rst of ldap but it seems that radius receive an empty response from AD but is not correct... 2013/10/25 Davide Garofalo <davide.garofalo@gmail.com>
hi all, i've a big problem with the new module ldap. when i perform a ldap request i've this error Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. Fri Oct 25 14:16:30 2013 : ERROR: (0) ERROR: Server said: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece.
Here <https://dl.dropboxusercontent.com/u/15956439/radius3/default> you can find my sites default configuration here <https://dl.dropboxusercontent.com/u/15956439/radius3/ldap> you can find my ldap module configuration here <https://dl.dropboxusercontent.com/u/15956439/radius3/debug> you can find the full debug output and here <https://dl.dropboxusercontent.com/u/15956439/radius3/scan> a trace that you can open with wireshark
Where i wrong???
Thank you
-- *Davide Garofalo*
-- *Davide Garofalo*
Davide Garofalo wrote:
No copy and paste of configuration, is a fresh install e the site-enable/default is the original file. I've read the README.rst of ldap but it seems that radius receive an empty response from AD but is not correct...
Looks like a bug in the ldap module. We're looking at it now. Alan DeKok.
On 25 Oct 2013, at 13:42, Davide Garofalo <davide.garofalo@gmail.com> wrote:
No copy and paste of configuration, is a fresh install e the site-enable/default is the original file. I've read the README.rst of ldap but it seems that radius receive an empty response from AD but is not correct…
Fixed. Was always defaulting to library defaults, got broken during a refactor where we removed the config parser call from the module init code. Previously you could set defaults directly in the config struct, then call the config parser to actually populate it with values from the config. Sorry about that. Fixes in master and v3.0.x. It’ll go out with 3.0.1 which’ll go out when were sure these stupid mavericks issues are fixed, grrr. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Ok i hope it will go out as soon as possible. Thank you very much Davide Il 25/ott/2013 15:50 "Arran Cudbard-Bell" <a.cudbardb@freeradius.org> ha scritto:
On 25 Oct 2013, at 13:42, Davide Garofalo <davide.garofalo@gmail.com> wrote:
No copy and paste of configuration, is a fresh install e the site-enable/default is the original file. I've read the README.rst of ldap but it seems that radius receive an empty response from AD but is not correct…
Fixed. Was always defaulting to library defaults, got broken during a refactor where we removed the config parser call from the module init code.
Previously you could set defaults directly in the config struct, then call the config parser to actually populate it with values from the config.
Sorry about that.
Fixes in master and v3.0.x. It’ll go out with 3.0.1 which’ll go out when were sure these stupid mavericks issues are fixed, grrr.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
So i`ve to try a New istance of sites-enabled ??? I can try it in 3 hours because i`m in Italy and now i have to play Soccer :) Il 25/ott/2013 17:54 "Arran Cudbard-Bell" <a.cudbardb@freeradius.org> ha scritto:
On 25 Oct 2013, at 15:29, Davide Garofalo <davide.garofalo@gmail.com> wrote:
Ok i hope it will go out as soon as possible.
can you test please? I don’t have access to AD.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
ok, I tried to follow your advice but I do not think I've followed the right path I created a new virtual_server named 'test' for client localhost in clients.conf file. In sites-enebled directory, i created a new file named test that include server test { ... .... }, but the results is the same error. I received an access-accept by the mschap module but in post-auth the ldap module give me the same error. At this point i will wait the new release for freeradius. FR2 works very very fine but it doesn't include the passchange module that i need in my 802.1x network infrastructure. Approximately, you know when you distribute a new version of freeradius? one week or some months? ;) Thank you very much for your support. Davide 2013/10/25 Davide Garofalo <davide.garofalo@gmail.com>
So i`ve to try a New istance of sites-enabled ??? I can try it in 3 hours because i`m in Italy and now i have to play Soccer :) Il 25/ott/2013 17:54 "Arran Cudbard-Bell" <a.cudbardb@freeradius.org> ha scritto:
On 25 Oct 2013, at 15:29, Davide Garofalo <davide.garofalo@gmail.com> wrote:
Ok i hope it will go out as soon as possible.
can you test please? I don’t have access to AD.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
On 25 Oct 2013, at 21:04, Davide Garofalo <davide.garofalo@gmail.com> wrote:
ok, I tried to follow your advice but I do not think I've followed the right path I created a new virtual_server named 'test' for client localhost in clients.conf file. In sites-enebled directory, i created a new file named test that include server test { ... .... }, but the results is the same error.
*sigh* No, it’s referring to instances of the module… Why would a different virtual server require a different LDAP Group attribute? ldap <instance> { } will result in <instance>-LDAP-Group being registered Which you should then use as <instance>-LDAP-Group == "foo" -Arran
Approximately, you know when you distribute a new version of freeradius? one week or some months? ;)
Faster when people test the code so we can be sure it works. Should be a week or two. But honestly with v3.0.x there are no major code changes, -v includes the git commit hash, there's no reason to not run that in production. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
ok, i tried whit a new istance of ldap -> ldap test {....} and in default site in post-auth section i call -> if (test-Ldap-Group == "foo"){......} but i've the same error.... I am available for further testing. Davide 2013/10/26 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
On 25 Oct 2013, at 21:04, Davide Garofalo <davide.garofalo@gmail.com> wrote:
ok, I tried to follow your advice but I do not think I've followed the right path I created a new virtual_server named 'test' for client localhost in clients.conf file. In sites-enebled directory, i created a new file named test that include server test { ... .... }, but the results is the same error.
*sigh*
No, it’s referring to instances of the module… Why would a different virtual server require a different LDAP Group attribute?
ldap <instance> {
}
will result in
<instance>-LDAP-Group being registered
Which you should then use as
<instance>-LDAP-Group == "foo"
-Arran
Approximately, you know when you distribute a new version of freeradius? one week or some months? ;)
Faster when people test the code so we can be sure it works. Should be a week or two. But honestly with v3.0.x there are no major code changes, -v includes the git commit hash, there's no reason to not run that in production.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
OK FR3 development team, I understand... urra!!!! I downloaded the latest release of FR3 directly from the git. But now I get this error: (0) Performing search in 'dc=intra,dc=ismaa,dc=it' with filter '(&(objectCategory=person)(objectClass=user)(sAMAccountName=critest))' (0) Waiting for search result... *ASSERT FAILED src/modules/rlm_ldap/ldap.c[1028]: handle == conn->handle* 2013/10/26 Davide Garofalo <davide.garofalo@gmail.com>
ok, i tried whit a new istance of ldap -> ldap test {....} and in default site in post-auth section i call -> if (test-Ldap-Group == "foo"){......} but i've the same error....
I am available for further testing.
Davide
2013/10/26 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
On 25 Oct 2013, at 21:04, Davide Garofalo <davide.garofalo@gmail.com> wrote:
ok, I tried to follow your advice but I do not think I've followed the right path I created a new virtual_server named 'test' for client localhost in clients.conf file. In sites-enebled directory, i created a new file named test that include server test { ... .... }, but the results is the same error.
*sigh*
No, it’s referring to instances of the module… Why would a different virtual server require a different LDAP Group attribute?
ldap <instance> {
}
will result in
<instance>-LDAP-Group being registered
Which you should then use as
<instance>-LDAP-Group == "foo"
-Arran
Approximately, you know when you distribute a new version of freeradius? one week or some months? ;)
Faster when people test the code so we can be sure it works. Should be a week or two. But honestly with v3.0.x there are no major code changes, -v includes the git commit hash, there's no reason to not run that in production.
Arran Cudbard-Bell <a.cudbardb@freeradius.org>
FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
-- *Davide Garofalo*
in ldap.c before rad_assert(handle == conn->handle); i've put this debug line DEBUG("rlm_ldap (%s): Rebinding to URL %s", conn->inst->xlat_name, url); and the result is (0) Performing search in 'dc=intra,dc=ismaa,dc=it' with filter '(&(objectCategory=person)(objectClass=user)(sAMAccountName=garofalod))' (0) Waiting for search result... rlm_ldap ((null)): Rebinding to URL ldap:// ForestDnsZones.intra.ismaa.it/DC=ForestDnsZones,DC=intra,DC=ismaa,DC=it ASSERT FAILED src/modules/rlm_ldap/ldap.c[1030]: handle == conn->handle Annullato 2013/10/28 Davide Garofalo <davide.garofalo@gmail.com>
OK FR3 development team, I understand... urra!!!!
I downloaded the latest release of FR3 directly from the git. But now I get this error:
(0) Performing search in 'dc=intra,dc=ismaa,dc=it' with filter '(&(objectCategory=person)(objectClass=user)(sAMAccountName=critest))' (0) Waiting for search result...
*ASSERT FAILED src/modules/rlm_ldap/ldap.c[1028]: handle == conn->handle*
2013/10/26 Davide Garofalo <davide.garofalo@gmail.com>
ok, i tried whit a new istance of ldap -> ldap test {....} and in default site in post-auth section i call -> if (test-Ldap-Group == "foo"){......} but i've the same error....
I am available for further testing.
Davide
2013/10/26 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
On 25 Oct 2013, at 21:04, Davide Garofalo <davide.garofalo@gmail.com> wrote:
ok, I tried to follow your advice but I do not think I've followed the right path I created a new virtual_server named 'test' for client localhost in clients.conf file. In sites-enebled directory, i created a new file named test that include server test { ... .... }, but the results is the same error.
*sigh*
No, it’s referring to instances of the module… Why would a different virtual server require a different LDAP Group attribute?
ldap <instance> {
}
will result in
<instance>-LDAP-Group being registered
Which you should then use as
<instance>-LDAP-Group == "foo"
-Arran
Approximately, you know when you distribute a new version of freeradius? one week or some months? ;)
Faster when people test the code so we can be sure it works. Should be a week or two. But honestly with v3.0.x there are no major code changes, -v includes the git commit hash, there's no reason to not run that in production.
Arran Cudbard-Bell <a.cudbardb@freeradius.org>
FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
-- *Davide Garofalo*
-- *Davide Garofalo*
On 28 Oct 2013, at 10:19, Davide Garofalo <davide.garofalo@gmail.com> wrote:
in ldap.c before rad_assert(handle == conn->handle); i've put this debug line DEBUG("rlm_ldap (%s): Rebinding to URL %s", conn->inst->xlat_name, url);
and the result is
(0) Performing search in 'dc=intra,dc=ismaa,dc=it' with filter '(&(objectCategory=person)(objectClass=user)(sAMAccountName=garofalod))' (0) Waiting for search result... rlm_ldap ((null)): Rebinding to URL ldap://ForestDnsZones.intra.ismaa.it/DC=ForestDnsZones,DC=intra,DC=ismaa,DC=it ASSERT FAILED src/modules/rlm_ldap/ldap.c[1030]: handle == conn->handle Annullato
Fixed. Somehow inst (module configuration) was being passed as the ctx argument to the rebind function. The assert was valid. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Sorry Arran, but now starting radius i've this error: rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to 10.0.0.19:389 ASSERT FAILED src/modules/rlm_ldap/ldap.c[526]: *pconn && (*pconn)->handle Thank you very much for your support!! 2013/10/28 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
On 28 Oct 2013, at 10:19, Davide Garofalo <davide.garofalo@gmail.com> wrote:
in ldap.c before rad_assert(handle == conn->handle); i've put this debug line DEBUG("rlm_ldap (%s): Rebinding to URL %s", conn->inst->xlat_name, url);
and the result is
(0) Performing search in 'dc=intra,dc=ismaa,dc=it' with filter '(&(objectCategory=person)(objectClass=user)(sAMAccountName=garofalod))' (0) Waiting for search result... rlm_ldap ((null)): Rebinding to URL ldap:// ForestDnsZones.intra.ismaa.it/DC=ForestDnsZones,DC=intra,DC=ismaa,DC=it ASSERT FAILED src/modules/rlm_ldap/ldap.c[1030]: handle == conn->handle Annullato
Fixed. Somehow inst (module configuration) was being passed as the ctx argument to the rebind function. The assert was valid.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
On 28 Oct 2013, at 11:47, Davide Garofalo <davide.garofalo@gmail.com> wrote:
Sorry Arran, but now starting radius i've this error:
rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to 10.0.0.19:389 ASSERT FAILED src/modules/rlm_ldap/ldap.c[526]: *pconn && (*pconn)->handle
Thank you very much for your support!!
Fixed. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
yeah! it works!!! thank you very much!!! 2013/10/28 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
On 28 Oct 2013, at 11:47, Davide Garofalo <davide.garofalo@gmail.com> wrote:
Sorry Arran, but now starting radius i've this error:
rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to 10.0.0.19:389 ASSERT FAILED src/modules/rlm_ldap/ldap.c[526]: *pconn && (*pconn)->handle
Thank you very much for your support!!
Fixed.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Davide Garofalo -
Matthew Newton