Unable to Find Active Directory Group using LDAP Group Lookup module
Hello, We have successfully integrated our FreeRADIUS Version 3.2.6 with active directory using ntlm_auth module and also enabled sqlcounter to permit users with specific daily limit. All working well. However, part of the requirements is to give a specific time quota to users who are part of a specific AD group, which we guess is a common use case. To achieve this, we also integrated FR with ldap by using FreeRadius-ldap package and we populated the ldap configuration file with below: ldap section: server = '192.168.1.1' identity = 'cn=test,cn=Users,dc=domain,dc=com' password = 'xxxxxx' base_dn = 'CN=users,DC=domain,DC=com' ldap Group section: (As-is) In the Authorize or Post-Auth section we added below: if (LDAP-Group == "Office-VPN") { update reply { Reply-Message := "test reply" } } When we run radiusd -X, the ldap part is executed in the authorize section however it says "Search returned no results": (1) authorize { (1) if (LDAP-Group == "Office-VPN") { (1) Searching for user in group "Office-VPN" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) --> (uid=test) (1) Performing search in "CN=users,DC=domain,DC=com" with filter "(uid=test)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.1:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) if (LDAP-Group == "Office-VPN") -> FALSE In our active directory the user "test" is part of the "Office-VPN" group and both the user and group are inside "cn=Users,dc=domain,dc=com" Also when we run the ldapsearch command from within FR machine, we get positive results: ldapsearch -x -b "cn=Users,dc=domain,dc=com" -D "cn=test,cn=Users,dc=domain,dc=com" -h 192.168.1.1-w "xxxxxx" '(&(cn=Office-VPN))' # extended LDIF # # LDAPv3 # base <cn=Users,dc=domain,dc=com> with scope subtree # filter: (&(cn=Office-VPN)) # requesting: ALL # # Office-VPN, Users, domain.com dn: CN=Office-VPN,CN=Users,DC= domain,DC=com objectClass: top objectClass: group cn: Office-VPN member: CN=test,CN=Users,DC=domain,DC=com distinguishedName: CN=Office-VPN,CN=Users,DC=domain,DC=com instanceType: 4 whenCreated: 20241008110114.0Z whenChanged: 20241008131130.0Z uSNCreated: 134205037 uSNChanged: 134208547 name: Office-VPN objectGUID:: bJ2ut8zDLUu8jhVkbMh7mQ== objectSid:: AQUAAAAAAAUVAAAAEBY0cDMJoyrnPWkPzxYAAA== sAMAccountName: Office-VPN sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=domain,DC=com dSCorePropagationData: 20241008120926.0Z dSCorePropagationData: 20241008114220.0Z dSCorePropagationData: 16010101000000.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What do you think could be the issue? By the way, we also tried to change the parameter like filter = '(objectClass=posixGroup)' to use filter = '(objectClass=group)' and that didn't work either. Appreciate your help
On Oct 8, 2024, at 10:23 AM, Ibrahim Almahfooz <ibrahim.nezar@sevennet.net> wrote:
We have successfully integrated our FreeRADIUS Version 3.2.6 with active directory using ntlm_auth module and also enabled sqlcounter to permit users with specific daily limit.
That's good.
All working well. However, part of the requirements is to give a specific time quota to users who are part of a specific AD group, which we guess is a common use case.
Yes.
To achieve this, we also integrated FR with ldap by using FreeRadius-ldap package and we populated the ldap configuration file with below: ... When we run radiusd -X, the ldap part is executed in the authorize section however it says "Search returned no results":
That means the LDAP server returned no results. i..e. the query is wrong, or it is returning no data.
In our active directory the user "test" is part of the "Office-VPN" group and both the user and group are inside "cn=Users,dc=domain,dc=com"
Also when we run the ldapsearch command from within FR machine, we get positive results: ldapsearch -x -b "cn=Users,dc=domain,dc=com" -D "cn=test,cn=Users,dc=domain,dc=com" -h 192.168.1.1-w "xxxxxx" '(&(cn=Office-VPN))'
The comments in the ldap module suggest to use a different search string for Active Directory. Try that. My guess is that the LDAP search string is wrong. Alan DeKok.
Found the issue, my bad didn't read the comment of the user section I was focusing on the group section only. it was related to uid and samaccountname in the filter of the user section inside the ldap module: Instead of the original filter: ## filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" I updated to this filter: filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" Thanks for guidance Alan On Tue, 8 Oct 2024 at 17:23, Ibrahim Almahfooz <ibrahim.nezar@sevennet.net> wrote:
Hello,
We have successfully integrated our FreeRADIUS Version 3.2.6 with active directory using ntlm_auth module and also enabled sqlcounter to permit users with specific daily limit. All working well. However, part of the requirements is to give a specific time quota to users who are part of a specific AD group, which we guess is a common use case.
To achieve this, we also integrated FR with ldap by using FreeRadius-ldap package and we populated the ldap configuration file with below:
ldap section:
server = '192.168.1.1' identity = 'cn=test,cn=Users,dc=domain,dc=com' password = 'xxxxxx' base_dn = 'CN=users,DC=domain,DC=com'
ldap Group section: (As-is)
In the Authorize or Post-Auth section we added below:
if (LDAP-Group == "Office-VPN") { update reply { Reply-Message := "test reply" } }
When we run radiusd -X, the ldap part is executed in the authorize section however it says "Search returned no results":
(1) authorize { (1) if (LDAP-Group == "Office-VPN") { (1) Searching for user in group "Office-VPN" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) --> (uid=test) (1) Performing search in "CN=users,DC=domain,DC=com" with filter "(uid=test)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.1:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) if (LDAP-Group == "Office-VPN") -> FALSE
In our active directory the user "test" is part of the "Office-VPN" group and both the user and group are inside "cn=Users,dc=domain,dc=com"
Also when we run the ldapsearch command from within FR machine, we get positive results: ldapsearch -x -b "cn=Users,dc=domain,dc=com" -D "cn=test,cn=Users,dc=domain,dc=com" -h 192.168.1.1-w "xxxxxx" '(&(cn=Office-VPN))' # extended LDIF # # LDAPv3 # base <cn=Users,dc=domain,dc=com> with scope subtree # filter: (&(cn=Office-VPN)) # requesting: ALL #
# Office-VPN, Users, domain.com dn: CN=Office-VPN,CN=Users,DC= domain,DC=com objectClass: top objectClass: group cn: Office-VPN member: CN=test,CN=Users,DC=domain,DC=com distinguishedName: CN=Office-VPN,CN=Users,DC=domain,DC=com instanceType: 4 whenCreated: 20241008110114.0Z whenChanged: 20241008131130.0Z uSNCreated: 134205037 uSNChanged: 134208547 name: Office-VPN objectGUID:: bJ2ut8zDLUu8jhVkbMh7mQ== objectSid:: AQUAAAAAAAUVAAAAEBY0cDMJoyrnPWkPzxYAAA== sAMAccountName: Office-VPN sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=domain,DC=com dSCorePropagationData: 20241008120926.0Z dSCorePropagationData: 20241008114220.0Z dSCorePropagationData: 16010101000000.0Z
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
What do you think could be the issue?
By the way, we also tried to change the parameter like filter = '(objectClass=posixGroup)' to use filter = '(objectClass=group)' and that didn't work either.
Appreciate your help
-- Ibrahim Abdulatif IT and EPC Core Signaling Manager Sevennet Layers Co., LTD. +964 (0) 53 511 5514 <+964+(0)+53+511+5514> | +964 (0) 770 471 5514 <+964+(0)+770+471+5514> www.sevennet.net 2nd Floor, Faruk Investment Group, Salim Street, Sulaymaniyah, Iraq
participants (2)
-
Alan DeKok -
Ibrahim Almahfooz