Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution? (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Checking for suffix after "@" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "adp+ipad@vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Found realm "~vt.edu$" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Stripped-User-Name = "adp+ipad" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Realm = "vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Authentication realm is LOCAL (12813372) Tue Oct 18 10:08:33 2016: Debug: [suffix] = ok (12813372) Tue Oct 18 10:08:33 2016: Debug: update control { (12813372) Tue Oct 18 10:08:33 2016: Debug: } # update control = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: Peer sent EAP Response (code 2) ID 12 length 74 (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: No EAP Start, assuming it's an on-going EAP conversation (12813372) Tue Oct 18 10:08:33 2016: Debug: [eap] = updated (12813372) Tue Oct 18 10:08:33 2016: Debug: [files] = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: --> (uid=adp\5c2bipad) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=adp\5c2bipad)", scope "sub" (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Waiting for search result... (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Search returned no results (12813372) Tue Oct 18 10:08:33 2016: Debug: [ldap] = notfound <http://aka.ms/weboutlook>
I should mention that I have a few machines still running on FRS 3.0.4, with the same ldap config and filter, and this user is returned correctly during those auth requests. ________________________________ From: Mark Williams <martialstudy@hotmail.com> Sent: Tuesday, October 18, 2016 10:44 AM To: FreeRadius users mailing list Subject: Transformation of the + symbol -- FRS 3.0.11 Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution? (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Checking for suffix after "@" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "adp+ipad@vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Found realm "~vt.edu$" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Stripped-User-Name = "adp+ipad" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Realm = "vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Authentication realm is LOCAL (12813372) Tue Oct 18 10:08:33 2016: Debug: [suffix] = ok (12813372) Tue Oct 18 10:08:33 2016: Debug: update control { (12813372) Tue Oct 18 10:08:33 2016: Debug: } # update control = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: Peer sent EAP Response (code 2) ID 12 length 74 (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: No EAP Start, assuming it's an on-going EAP conversation (12813372) Tue Oct 18 10:08:33 2016: Debug: [eap] = updated (12813372) Tue Oct 18 10:08:33 2016: Debug: [files] = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: --> (uid=adp\5c2bipad) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=adp\5c2bipad)", scope "sub" (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Waiting for search result... (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Search returned no results (12813372) Tue Oct 18 10:08:33 2016: Debug: [ldap] = notfound <http://aka.ms/weboutlook>
On Oct 18, 2016, at 10:44 AM, Mark Williams <martialstudy@hotmail.com> wrote:
Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution?
The + character has special meaning in LDAP. As such, it's escaped. Alan DeKok.
It does have a special meaning, but the method which FR is escaping the + character seems to have changed since version 3.0.4, and doesn't appear to be working (in my environment at least). If I run radtest against FRS-3.0.4 I get debug like this: (10356) Wed Nov Checking for suffix after "@" (10356) Wed Nov Looking up realm "vt.edu" for User-Name = "bob+ipad1@vt.edu" (10356) Wed Nov Found realm "vt.edu" (10356) Wed Nov Adding Stripped-User-Name = "bob+ipad1" (10356) Wed Nov Adding Realm = "vt.edu" (10356) Wed Nov Authentication realm is LOCAL (10356) Wed Nov 2 13:53:33 2016 : Debug: [suffix] = ok (10356) Wed NoNo EAP-Message, not doing EAP (10356) Wed Nov 2 13:53:33 2016 : Debug: [eap] = noop (10356) Wed NovEXPAND (&(uid=%{Stripped-User-Name})) (10356) Wed Nov --> (&(uid=bob\2bipad1)) (10356) Wed NovEXPAND ou=People,ou=NIS,o=vt (10356) Wed Nov --> ou=People,ou=NIS,o=vt (10356) Wed NovPerforming search in 'ou=People,ou=NIS,o=vt' with filter '(&(uid=bob\2bipad1))', scope 'sub' (10356) Wed NovWaiting for search result... (10356) Wed NovUser object found at DN "nuid=007,ou=Agents,ou=People,ou=NIS,o=vt" (10356) Wed NovProcessing user attributes And the corresponding OpenLDAP logs appear so: 2016-11-02T13:43:33.525988-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SRCH base="ou=People,ou=NIS,o=vt" scope=2 deref=0 filter="(&(uid=bob+ipad1))" 2016-11-02T13:43:33.526006-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SRCH attr=userPassword ntPassword prohibited 2016-11-02T13:43:33.526009-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SEARCH RESULT tag=101 err=0 nentries=1 text= Running it against FRS-3.0.11 I get debug like this: (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Checking for suffix after "@" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "bob+ipad1@vt.edu" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Found realm "~vt.edu$" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Adding Stripped-User-Name = "bob+ipad1" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Adding Realm = "vt.edu" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Authentication realm is LOCAL (7474379) Wed Nov 2 13:37:02 2016: Debug: [suffix] = ok (7474379) Wed Nov 2 13:37:02 2016: Debug: eap: No EAP-Message, not doing EAP (7474379) Wed Nov 2 13:37:02 2016: Debug: [eap] = noop (7474379) Wed Nov 2 13:37:02 2016: Debug: [files] = noop (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: --> (uid=bob\5c2bipad1) (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=bob\5c2bipad1)", scope "sub" (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Waiting for search result... (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Search returned no results (7474379) Wed Nov 2 13:37:02 2016: Debug: [ldap] = notfound And the corresponding OpenLDAP logs appear so: 2016-11-02T13:37:02.360308-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SRCH base="ou=People,ou=NIS,o=vt" scope=2 deref=0 filter="(uid=bob\5C2bipad1)" 2016-11-02T13:37:02.360550-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SRCH attr=userPassword ntPassword prohibited radiusControlAttribute radiusRequestAttribute radiusReplyAttribute 2016-11-02T13:37:02.360818-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SEARCH RESULT tag=101 err=0 nentries=0 text= <http://aka.ms/weboutlook> ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Tuesday, October 18, 2016 2:05 PM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11 On Oct 18, 2016, at 10:44 AM, Mark Williams <martialstudy@hotmail.com> wrote:
Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution?
The + character has special meaning in LDAP. As such, it's escaped. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 2, 2016, at 2:26 PM, Mark Williams <martialstudy@hotmail.com> wrote:
It does have a special meaning, but the method which FR is escaping the + character seems to have changed since version 3.0.4, and doesn't appear to be working (in my environment at least).
What's the DN of the object you're actually trying to resolve? -Arran
The dn includes the nuid, which is significantly large number we generate randomly when 'People' records are created. Records are similar to this: dn: nuid=007,ou=People,ou=NIS,o=vt nuid: 007 uid: bob sn: bob cn: CN - bob objectClass: nisUserAccount objectClass: inetOrgPerson objectClass: radiusprofile prohibited: FALSE userPassword:: hashedblahblahblah dn: nuid=008,ou=Entitlements,ou=NIS,o=vt nuid: 008 entitled: nuid=007,ou=People,ou=NIS,o=vt entitledUID: bob entitlement: service.wireless objectClass: nisEntitlement We filter on the unique 'uid' field, and then an 'entitleduid' field: The ldap config in both versions: ldap { server = "localhost" port = 11389 base_dn = "ou=NIS,o=vt" identity = "uid=radius,ou=Local,${base_dn}" password = blahblahblah update { control:Password-With-Header += 'userPassword' control:NT-Password := 'ntPassword' control:Prohibited := 'prohibited' } user { base_dn = "ou=People,${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' } group { base_dn = "ou=Entitlements,${..base_dn}" filter = "(objectClass=nisEntitlement)" scope = 'sub' name_attribute = "entitlement" membership_filter = "(&(entitledUID=%{Stripped-User-Name})(|(!(expirationEpoch=*))(expirationEpoch>=%l)))" } ... } ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Wednesday, November 02, 2016 2:33 PM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11
On Nov 2, 2016, at 2:26 PM, Mark Williams <martialstudy@hotmail.com> wrote:
It does have a special meaning, but the method which FR is escaping the + character seems to have changed since version 3.0.4, and doesn't appear to be working (in my environment at least).
What's the DN of the object you're actually trying to resolve? -Arran
Let's try cutting and pasting that again, shall we... ldap{ server="localhost" port=11389 base_dn="ou=NIS,o=vt" identity="uid=radius,ou=Local,${base_dn}" password=blahblahblah update{ control:Password-With-Header+="userPassword" control:NT-Password:="ntPassword" control:Prohibited:="prohibited" } user{ base_dn="ou=People,${..base_dn}" filter="(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope="sub" } group{ base_dn="ou=Entitlements,${..base_dn}" filter="(objectClass=nisEntitlement)" scope="sub" name_attribute="entitlement" membership_filter="(&(entitledUID=%{Stripped-User-Name})(|(!(expirationEpoch=*))(expirationEpoch>=%l)))" } ... } ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Mark Williams <martialstudy@hotmail.com> Sent: Thursday, November 03, 2016 7:04 AM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11 The dn includes the nuid, which is significantly large number we generate randomly when 'People' records are created. Records are similar to this: dn: nuid=007,ou=People,ou=NIS,o=vt nuid: 007 uid: bob sn: bob cn: CN - bob objectClass: nisUserAccount objectClass: inetOrgPerson objectClass: radiusprofile prohibited: FALSE userPassword:: hashedblahblahblah dn: nuid=008,ou=Entitlements,ou=NIS,o=vt nuid: 008 entitled: nuid=007,ou=People,ou=NIS,o=vt entitledUID: bob entitlement: service.wireless objectClass: nisEntitlement We filter on the unique 'uid' field, and then an 'entitleduid' field: The ldap config in both versions: ldap { server = "localhost" port = 11389 base_dn = "ou=NIS,o=vt" identity = "uid=radius,ou=Local,${base_dn}" password = blahblahblah update { control:Password-With-Header += 'userPassword' control:NT-Password := 'ntPassword' control:Prohibited := 'prohibited' } user { base_dn = "ou=People,${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' } group { base_dn = "ou=Entitlements,${..base_dn}" filter = "(objectClass=nisEntitlement)" scope = 'sub' name_attribute = "entitlement" membership_filter = "(&(entitledUID=%{Stripped-User-Name})(|(!(expirationEpoch=*))(expirationEpoch>=%l)))" } ... } ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Wednesday, November 02, 2016 2:33 PM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11
On Nov 2, 2016, at 2:26 PM, Mark Williams <martialstudy@hotmail.com> wrote:
It does have a special meaning, but the method which FR is escaping the + character seems to have changed since version 3.0.4, and doesn't appear to be working (in my environment at least).
What's the DN of the object you're actually trying to resolve? -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html FreeRADIUS -- users' list info<http://www.freeradius.org/list/users.html> www.freeradius.org Users' List Information. The freeradius-users mailing list is for users of the FreeRADIUS server not Cistron's server! There are a few house-rules to which we'd like ...
Sure thing. I'm going to run a few more tests, and then I'll open an issue. ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Arran Cudbard-Bell <a.cudbardb@freeradius.org> Sent: Thursday, November 03, 2016 9:33 AM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11
On Nov 3, 2016, at 7:10 AM, Mark Williams <martialstudy@hotmail.com> wrote:
Let's try cutting and pasting that again, shall we...
I agree, it looks like it's being double escaped. Can you open a GitHub issue. Thanks, -Arran
I’m no LDAP expert, but isn’t \5c the escape for the backslash character itself? It’s almost as though FRS is attempting to hand the server \+ instead of just + ? ________________________________ From: Mark Williams <martialstudy@hotmail.com> Sent: Wednesday, November 02, 2016 2:26 PM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11 It does have a special meaning, but the method which FR is escaping the + character seems to have changed since version 3.0.4, and doesn’t appear to be working (in my environment at least). If I run radtest against FRS-3.0.4 I get debug like this: (10356) Wed Nov Checking for suffix after "@" (10356) Wed Nov Looking up realm "vt.edu" for User-Name = "bob+ipad1@vt.edu" (10356) Wed Nov Found realm "vt.edu" (10356) Wed Nov Adding Stripped-User-Name = "bob+ipad1" (10356) Wed Nov Adding Realm = "vt.edu" (10356) Wed Nov Authentication realm is LOCAL (10356) Wed Nov 2 13:53:33 2016 : Debug: [suffix] = ok (10356) Wed NoNo EAP-Message, not doing EAP (10356) Wed Nov 2 13:53:33 2016 : Debug: [eap] = noop (10356) Wed NovEXPAND (&(uid=%{Stripped-User-Name})) (10356) Wed Nov --> (&(uid=bob\2bipad1)) (10356) Wed NovEXPAND ou=People,ou=NIS,o=vt (10356) Wed Nov --> ou=People,ou=NIS,o=vt (10356) Wed NovPerforming search in 'ou=People,ou=NIS,o=vt' with filter '(&(uid=bob\2bipad1))', scope 'sub' (10356) Wed NovWaiting for search result... (10356) Wed NovUser object found at DN “nuid=007,ou=Agents,ou=People,ou=NIS,o=vt" (10356) Wed NovProcessing user attributes And the corresponding OpenLDAP logs appear so: 2016-11-02T13:43:33.525988-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SRCH base="ou=People,ou=NIS,o=vt" scope=2 deref=0 filter="(&(uid=bob+ipad1))" 2016-11-02T13:43:33.526006-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SRCH attr=userPassword ntPassword prohibited 2016-11-02T13:43:33.526009-04:00 ldap01.cns.vt.edu slapd[2685]: conn=226728 op=333 SEARCH RESULT tag=101 err=0 nentries=1 text= Running it against FRS-3.0.11 I get debug like this: (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Checking for suffix after "@" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "bob+ipad1@vt.edu" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Found realm "~vt.edu$" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Adding Stripped-User-Name = "bob+ipad1" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Adding Realm = "vt.edu" (7474379) Wed Nov 2 13:37:02 2016: Debug: suffix: Authentication realm is LOCAL (7474379) Wed Nov 2 13:37:02 2016: Debug: [suffix] = ok (7474379) Wed Nov 2 13:37:02 2016: Debug: eap: No EAP-Message, not doing EAP (7474379) Wed Nov 2 13:37:02 2016: Debug: [eap] = noop (7474379) Wed Nov 2 13:37:02 2016: Debug: [files] = noop (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: --> (uid=bob\5c2bipad1) (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=bob\5c2bipad1)", scope "sub" (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Waiting for search result... (7474379) Wed Nov 2 13:37:02 2016: Debug: ldap: Search returned no results (7474379) Wed Nov 2 13:37:02 2016: Debug: [ldap] = notfound And the corresponding OpenLDAP logs appear so: 2016-11-02T13:37:02.360308-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SRCH base="ou=People,ou=NIS,o=vt" scope=2 deref=0 filter="(uid=bob\5C2bipad1)" 2016-11-02T13:37:02.360550-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SRCH attr=userPassword ntPassword prohibited radiusControlAttribute radiusRequestAttribute radiusReplyAttribute 2016-11-02T13:37:02.360818-04:00 midge.cns.vt.edu slapd[3369]: conn=37934 op=43 SEARCH RESULT tag=101 err=0 nentries=0 text= <http://aka.ms/weboutlook> ________________________________ From: Freeradius-Users <freeradius-users-bounces+martialstudy=hotmail.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Tuesday, October 18, 2016 2:05 PM To: FreeRadius users mailing list Subject: Re: Transformation of the + symbol -- FRS 3.0.11 On Oct 18, 2016, at 10:44 AM, Mark Williams <martialstudy@hotmail.com> wrote:
Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution?
The + character has special meaning in LDAP. As such, it's escaped. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Mark Williams