LDAP-UserDn not populated? (Was: Re: Radius, LDAP and Openvpn)
You need to read the documentation, and *understand* how FreeRADIUS works. The alternative is random changes, confusion, upset users, and *more* work and pain.
Skipped the idea to use different LDAP attributes for WiFi and OpenVPN altogether and turned to the LDAP groups. But my Ldap-UserDn attribute wont get populated (even though user is successfully authenticated in LDAP). So group search obviously fails When I manually insert my test users DN, everything works as expected. read the rlm_ldap manual but i still do not understand why my LDAP-UserDn is not populated. A.
On 01/11/13 12:11, Andres Septer wrote:
You need to read the documentation, and *understand* how FreeRADIUS works. The alternative is random changes, confusion, upset users, and *more* work and pain.
Skipped the idea to use different LDAP attributes for WiFi and OpenVPN altogether and turned to the LDAP groups.
But my Ldap-UserDn attribute wont get populated (even though user is successfully authenticated in LDAP). So group search obviously fails
When I manually insert my test users DN, everything works as expected.
read the rlm_ldap manual but i still do not understand why my LDAP-UserDn is not populated.
Sigh. Debug please, as gathered with "radiusd -X". We're not psychic.
Logs LDAP search fail, because LDAP-UserDN empty Fri Nov 1 15:08:24 2013 : Info: +- entering group post-auth {...} Fri Nov 1 15:08:24 2013 : Info: ++? if (LDAP-Group == "WIFI") Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Nov 1 15:08:24 2013 : Info: expand: o=evrcargo -> o=evrcargo Fri Nov 1 15:08:24 2013 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: performing search in o=evrcargo, with filter (&(cn=WIFI)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: performing search in cn=Toomas,o=EVRCargo, with filter (objectclass=*) Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Nov 1 15:08:24 2013 : Info: ++? elsif (LDAP-Group == "OPENVPN") Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Nov 1 15:08:24 2013 : Info: expand: o=evrcargo -> o=evrcargo Fri Nov 1 15:08:24 2013 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: performing search in o=evrcargo, with filter (&(cn=OPENVPN)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: performing search in cn=Toomas,o=EVRCargo, with filter (objectclass=*) Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Nov 1 15:08:24 2013 : Info: ++- entering else else {...} Fri Nov 1 15:08:24 2013 : Info: +++[reject] returns reject Fri Nov 1 15:08:24 2013 : Info: ++- else else returns reject Fri Nov 1 15:08:24 2013 : Info: Using Post-Auth-Type Reject Fri Nov 1 15:08:24 2013 : Info: +- entering group REJECT {...} LDAP Bind Fri Nov 1 15:08:24 2013 : Info: [ldap] performing user authorization for toomas Fri Nov 1 15:08:24 2013 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Fri Nov 1 15:08:24 2013 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=toomas) Fri Nov 1 15:08:24 2013 : Info: [ldap] expand: o=evrcargo -> o=evrcargo Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: attempting LDAP reconnection Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: (re)connect to 192.168.99.60:636, authentication 0 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: setting TLS mode to 1 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: setting TLS CACert File to /etc/raddb/certs/evrc-ou.pam Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: setting TLS Require Cert to demand Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: bind as cn=anz,o=evrcargo/whatis to 192.168.99.60:636 Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: waiting for bind result ... Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: Bind was successful Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: performing search in o=evrcargo, with filter (uid=toomas) Fri Nov 1 15:08:24 2013 : Info: [ldap] checking if remote access for toomas is allowed by rADIUSEnableDialAccess Fri Nov 1 15:08:24 2013 : Info: [ldap] Added the eDirectory password XXXXXXXXXXXX in check items as Cleartext-Password Fri Nov 1 15:08:24 2013 : Info: [ldap] No default NMAS login sequence Fri Nov 1 15:08:24 2013 : Info: [ldap] looking for check items in directory... Fri Nov 1 15:08:24 2013 : Info: [ldap] looking for reply items in directory... Fri Nov 1 15:08:24 2013 : Info: [ldap] user toomas authorized to use remote access Fri Nov 1 15:08:24 2013 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Nov 1 15:08:24 2013 : Info: ++[ldap] returns ok 2013/11/1 Phil Mayers <p.mayers@imperial.ac.uk>
On 01/11/13 12:11, Andres Septer wrote:
You need to read the documentation, and *understand* how FreeRADIUS works. The alternative is random changes, confusion, upset users, and *more* work and pain.
Skipped the idea to use different LDAP attributes for WiFi and OpenVPN altogether and turned to the LDAP groups.
But my Ldap-UserDn attribute wont get populated (even though user is successfully authenticated in LDAP). So group search obviously fails
When I manually insert my test users DN, everything works as expected.
read the rlm_ldap manual but i still do not understand why my LDAP-UserDn is not populated.
Sigh. Debug please, as gathered with "radiusd -X". We're not psychic. - List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
On 01/11/13 13:11, Andres Septer wrote:
Logs LDAP search fail, because LDAP-UserDN empty
This is: a. Not a debug with "radiusd -X", and b. Not a complete debug. ...but never mind. I can see your problem:
(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))
...you have edited the default config and broken it. Go back to the default config and look carefully at what it says - you'll note it's: control:Ldap-UserDn
Thank you for answer, but I started messing with default configuration because this did not return any search results either. This is what my original configuration looked like <------># Group membership checking. Disabled by default. <------># <------># groupname_attribute = cn <------># groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" I used original conf to generate a debug log for this. And YES, the adding "control:" helped. So basically it's a package bug. I will inform Suse freeradius package maintainer. Thank you, again. Andres 2013/11/1 Phil Mayers <p.mayers@imperial.ac.uk>
On 01/11/13 13:11, Andres Septer wrote:
Logs LDAP search fail, because LDAP-UserDN empty
This is:
a. Not a debug with "radiusd -X", and b. Not a complete debug.
...but never mind. I can see your problem:
(|(&(objectClass=GroupOfNames)**(member=%{Ldap-UserDn}))
...you have edited the default config and broken it. Go back to the default config and look carefully at what it says - you'll note it's:
control:Ldap-UserDn
- List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
participants (2)
-
Andres Septer -
Phil Mayers