hi. i think that this problem is very similar to many people but i can´t find the solution. i´m trying authenticate users of windows with is own supplicant, when i try authenticate in local users no problem, however the problem is when i try it with openldap. i received a message. Auth: rlm_ldap: Attribute "User-Password" is required for authentication. Thu Apr 29 16:44:57 2010 : Auth: Login incorrect: [peter] (from client wifi port 6145 cli 00-74-05-A6-91-BD) i have read most about this problem but i can´t find de solution. I think that the problem is in mschap. i hope can help me. thanks -- i received a message. Auth: rlm_ldap: Attribute "User-Password" is required for authentication. Thu Apr 29 16:44:57 2010 : Auth: Login incorrect: [peter] (from client wifi port 6145 cli 00-74-05-A6-91-BD) i have read most about this problem but i can´t find de solution. I think that the problem is in mschap. i hope can help me. thanks --
Daniel Soto wrote:
i´m trying authenticate users of windows with is own supplicant, when i try authenticate in local users no problem, however the problem is when i try it with openldap.
Auth: rlm_ldap: Attribute "User-Password" is required for authentication.
You forced "Auth-Type := LDAP". Don't do that. It's breaking the server. If you delete that incorrect entry, it should work. Failing that... Read the debug output. Alan DeKok.
On 04/30/2010 02:50 AM, Daniel Soto wrote:
hi.
i think that this problem is very similar to many people but i can´t find the solution.
i´m trying authenticate users of windows with is own supplicant, when i try authenticate in local users no problem, however the problem is when i try it with openldap.
i received a message.
Auth: rlm_ldap: Attribute "User-Password" is required for authentication. Thu Apr 29 16:44:57 2010 : Auth: Login incorrect: [peter] (from client wifi port 6145 cli 00-74-05-A6-91-BD)
i have read most about this problem but i can´t find de solution.
If your debug output (which you didn't provide) contains this line: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Then the likely problem is this line is missing from /etc/raddb/ldap.attrmap checkItem Cleartext-Password userPassword Here is what might be going on: Many authentication protocols (i.e. mschap) require that a clear text password be available to the radius server. Hopefully you have set the userPassword attribute for your users in your ldap server and protected it with an ACL. rlm_ldap will lookup the user in ldap and requests the attributes defined in /etc/raddb/ldap.attrmap labeled "checkItem" and then adds those attributes it found to the request. The attribute retrieved from ldap is the 3rd item on the line, the radius attribute which is added to the request is the 2nd item on the line. Thus what the above does is to add Cleartext-Password as a radius check item to the request with the value of the ldap attribute userPassword for the user. For reasons I do not understand the above line is missing from the default ldap.attrmap and this has tripped numerous people up. Alan: Is there a reason why ldap.attrmap omits the clear text password retrieval? -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
John Dennis wrote:
On 04/30/2010 02:50 AM, Daniel Soto wrote:
hi.
i think that this problem is very similar to many people but i can´t find the solution.
i´m trying authenticate users of windows with is own supplicant, when i try authenticate in local users no problem, however the problem is when i try it with openldap.
i received a message.
Auth: rlm_ldap: Attribute "User-Password" is required for authentication. Thu Apr 29 16:44:57 2010 : Auth: Login incorrect: [peter] (from client wifi port 6145 cli 00-74-05-A6-91-BD)
i have read most about this problem but i can´t find de solution.
If your debug output (which you didn't provide) contains this line:
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
Then the likely problem is this line is missing from /etc/raddb/ldap.attrmap
checkItem Cleartext-Password userPassword
Here is what might be going on:
Many authentication protocols (i.e. mschap) require that a clear text password be available to the radius server. Hopefully you have set the userPassword attribute for your users in your ldap server and protected it with an ACL. rlm_ldap will lookup the user in ldap and requests the attributes defined in /etc/raddb/ldap.attrmap labeled "checkItem" and then adds those attributes it found to the request. The attribute retrieved from ldap is the 3rd item on the line, the radius attribute which is added to the request is the 2nd item on the line. Thus what the above does is to add Cleartext-Password as a radius check item to the request with the value of the ldap attribute userPassword for the user.
For reasons I do not understand the above line is missing from the default ldap.attrmap and this has tripped numerous people up.
Alan: Is there a reason why ldap.attrmap omits the clear text password retrieval?
I think you can safely ignore this warning, if authentication works. For example, I have PEAP/MS-CHAP-v2 setup, and FreeRADIUS queries my LDAP server and retrieves the ntPassword LDAP attribute. I do not use CHAP or PAP or any authentication method other than PEAP/MS-CHAP-v2, so I actually do *not* need to store the user's clear text password in the LDAP server... therefore I don't. I think I could remove the "checkitem Cleartext-Password userPassword" line in ldap.attrmap, and everything would still run fine. So I just ignore the "No "known good" password" warning. I haven't tried, but maybe if I set "password_attribute = ntPassword" in modules/ldap, it might remove the warning. You may want to try that ? Aurélien Geron
sorry, didn´t include the log, Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "md5" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "10.40.30.80" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 15 ldap: timelimit = 15 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "ou=prf,dc=uax,dc=es" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{md5}" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP chapPassword mapped to RADIUS CHAP-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x2ac416410640 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "gtc" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded attr_filter attr_filter: attrsfile = "/etc/raddb/attrs" rlm_attr_filter: Authorize method will be deprecated. Module: Instantiated attr_filter (attr_filter) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x:32840, id=183, length=148 User-Name = "peter" NAS-IP-Address = x.x.x.x NAS-Port = 6145 Called-Station-Id = "00-02-B6-33-58-B2:rad_pru" Calling-Station-Id = "00-22-74-A6-91-BD" Framed-MTU = 1250 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11a" EAP-Message = 0x0201000c016461786f63616d Message-Authenticator = 0xe74d9538d9499f002e149f972005f7af Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "peter", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for peter radius_xlat: '(uid=peter)' radius_xlat: 'ou=x,dc=x,dc=x' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to x.x.x:389, authentication 0 rlm_ldap: bind as / to x.x.x.x:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=prf,dc=uax,dc=es, with filter (uid=peter) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user peter authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 183 to x.x.x.x port 32840 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2ee2998b9fe8c4f9698291efe30cde7c Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 183 with timestamp 4bde771b Nothing to do. Sleeping until we see a request.
thanks i´ll try. ----- Mensaje original ----- De: "John Dennis" <jdennis@redhat.com> Para: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> CC: "Daniel Soto" <daxocam@uax.es> Enviados: Viernes, 30 de Abril 2010 13:55:36 Asunto: Re: supplicant winxp+freeradius+ldap On 04/30/2010 02:50 AM, Daniel Soto wrote:
hi.
i think that this problem is very similar to many people but i can´t find the solution.
i´m trying authenticate users of windows with is own supplicant, when i try authenticate in local users no problem, however the problem is when i try it with openldap.
i received a message.
Auth: rlm_ldap: Attribute "User-Password" is required for authentication. Thu Apr 29 16:44:57 2010 : Auth: Login incorrect: [peter] (from client wifi port 6145 cli 00-74-05-A6-91-BD)
i have read most about this problem but i can´t find de solution.
If your debug output (which you didn't provide) contains this line: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Then the likely problem is this line is missing from /etc/raddb/ldap.attrmap checkItem Cleartext-Password userPassword Here is what might be going on: Many authentication protocols (i.e. mschap) require that a clear text password be available to the radius server. Hopefully you have set the userPassword attribute for your users in your ldap server and protected it with an ACL. rlm_ldap will lookup the user in ldap and requests the attributes defined in /etc/raddb/ldap.attrmap labeled "checkItem" and then adds those attributes it found to the request. The attribute retrieved from ldap is the 3rd item on the line, the radius attribute which is added to the request is the 2nd item on the line. Thus what the above does is to add Cleartext-Password as a radius check item to the request with the value of the ldap attribute userPassword for the user. For reasons I do not understand the above line is missing from the default ldap.attrmap and this has tripped numerous people up. Alan: Is there a reason why ldap.attrmap omits the clear text password retrieval? -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ -- Daniel Soto Dep. Comunicaciones U.A.X Daniel Soto Dep. Comunicaciones U.A.X
participants (4)
-
Alan DeKok -
Aurélien Geron -
Daniel Soto -
John Dennis