Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
Hi, Followed the diff forum threads and have managed to link the Freeradius to look for users from a Mysql DB but am still not able to successfully authenticate users in this setup.I get the following error on receiving a user request Received Access-Request Id 24 from 10.127.6.21:59169 to 10.127.6.244:1645 length 76 User-Name = 'test' User-Password = 'test' NAS-IP-Address = 10.127.6.21 Service-Type = Administrative-User Calling-Station-Id = '10.120.92.40' NAS-Port-Type = Virtual (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "test", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) sql : EXPAND %{User-Name} (1) sql : --> test (1) sql : SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (1) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id desc (1) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc' rlm_sql: Failed to create the pair: Invalid vendor name in attribute name "Password" rlm_sql (sql): Error parsing user data from database result (1) ERROR: sql : SQL query error But the user exists in the DB as we can see from the following output : SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc; +----+----------+-----------+-------+----+ | id | username | attribute | value | op | +----+----------+-----------+-------+----+ | 2 | test | Password | test | := | | 1 | test | Auth-Type | Local | := | +----+----------+-----------+-------+----+ 2 rows in set (0.00 sec) I have attached the configuration files along with this mail. Any help in this would be very much appreciated. Senthil KSK ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
Karuppasamy, Senthil wrote:
Followed the diff forum threads and have managed to link the Freeradius to look for users from a Mysql DB but am still not able to successfully authenticate users in this setup.I get the following error on receiving a user request ... *rlm_sql: Failed to create the pair: Invalid vendor name in attribute name "Password"*
There is no such attribute named "Password". Use "Cleartext-Password".
I have attached the configuration files along with this mail.
Please don't do that. It's not necessary. Alan DeKok.
Thanks for the quick reply. It worked but am still getting an access reject in the authenticate section : (3) Found Auth-Type = Local (3) # Executing section authenticate from file /etc/raddb/sites-enabled/default (3) Failed to authenticate the user. (3) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40) Am I missing something here ? Shouldn't Auth-Type as Local mean that he validates it against the username in the radcheck table ( namely test in this case ) ? Senthil KSK -----Original Message----- From: freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org [mailto:freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 19, 2014 8:38 PM To: FreeRadius users mailing list Subject: Re: Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password" Karuppasamy, Senthil wrote:
Followed the diff forum threads and have managed to link the Freeradius to look for users from a Mysql DB but am still not able to successfully authenticate users in this setup.I get the following error on receiving a user request ... *rlm_sql: Failed to create the pair: Invalid vendor name in attribute name "Password"*
There is no such attribute named "Password". Use "Cleartext-Password".
I have attached the configuration files along with this mail.
Please don't do that. It's not necessary. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
On 19 Nov 2014, at 10:28, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
Thanks for the quick reply. It worked but am still getting an access reject in the authenticate section :
(3) Found Auth-Type = Local (3) # Executing section authenticate from file /etc/raddb/sites-enabled/default (3) Failed to authenticate the user. (3) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40)
Am I missing something here ? Shouldn't Auth-Type as Local mean that he validates it against the username in the radcheck table ( namely test in this case ) ?
Yeah, you're missing the fact that he's used an unknown attribute in the previous row. "Password" is not a FreeRADIUS attribute. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 19 Nov 2014, at 10:40, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 19 Nov 2014, at 10:28, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
Thanks for the quick reply. It worked but am still getting an access reject in the authenticate section :
(3) Found Auth-Type = Local (3) # Executing section authenticate from file /etc/raddb/sites-enabled/default (3) Failed to authenticate the user. (3) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40)
Am I missing something here ? Shouldn't Auth-Type as Local mean that he validates it against the username in the radcheck table ( namely test in this case ) ?
Yeah, you're missing the fact that he's used an unknown attribute in the previous row.
"Password" is not a FreeRADIUS attribute.
Ah, got confused by your message. By "he" you're referring to the user. and no, you need to add pap to the authenticate section. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
It is enabled. I am seeing the following warning that might be pertinent about pap. (9) [sql] = notfound (9) [expiration] = noop (9) [logintime] = noop (9) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (9) WARNING: pap : Authentication will fail unless a "known good" password is available. -----Original Message----- From: freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org [mailto:freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Wednesday, November 19, 2014 9:17 PM To: FreeRadius users mailing list Subject: Re: Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
On 19 Nov 2014, at 10:40, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 19 Nov 2014, at 10:28, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
Thanks for the quick reply. It worked but am still getting an access reject in the authenticate section :
(3) Found Auth-Type = Local (3) # Executing section authenticate from file /etc/raddb/sites-enabled/default (3) Failed to authenticate the user. (3) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40)
Am I missing something here ? Shouldn't Auth-Type as Local mean that he validates it against the username in the radcheck table ( namely test in this case ) ?
Yeah, you're missing the fact that he's used an unknown attribute in the previous row.
"Password" is not a FreeRADIUS attribute.
Ah, got confused by your message. By "he" you're referring to the user. and no, you need to add pap to the authenticate section. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
On 19 Nov 2014, at 10:53, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
It is enabled. I am seeing the following warning that might be pertinent about pap.
(9) [sql] = notfound (9) [expiration] = noop (9) [logintime] = noop (9) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (9) WARNING: pap : Authentication will fail unless a "known good" password is available.
[sql] = notfound
So the SQL module failed to lookup the user... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Sorry for that. That was an earlier message. What I am getting is a Auth-Type already set message. rlm_sql_mysql: Starting connect to MySQL server (39) [sql] = ok (39) [expiration] = noop (39) [logintime] = noop (39) WARNING: pap : Auth-Type already set. Not setting to PAP (39) [pap] = noop (39) } # authorize = ok (39) Found Auth-Type = Local (39) # Executing section authenticate from file /etc/raddb/sites-enabled/default (39) Failed to authenticate the user. (39) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40) -----Original Message----- From: freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org [mailto:freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Wednesday, November 19, 2014 9:27 PM To: FreeRadius users mailing list Subject: Re: Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
On 19 Nov 2014, at 10:53, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
It is enabled. I am seeing the following warning that might be pertinent about pap.
(9) [sql] = notfound (9) [expiration] = noop (9) [logintime] = noop (9) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (9) WARNING: pap : Authentication will fail unless a "known good" password is available.
[sql] = notfound
So the SQL module failed to lookup the user... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
On 19 Nov 2014, at 11:03, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
Sorry for that. That was an earlier message. What I am getting is a Auth-Type already set message.
rlm_sql_mysql: Starting connect to MySQL server (39) [sql] = ok (39) [expiration] = noop (39) [logintime] = noop (39) WARNING: pap : Auth-Type already set. Not setting to PAP (39) [pap] = noop (39) } # authorize = ok (39) Found Auth-Type = Local (39) # Executing section authenticate from file /etc/raddb/sites-enabled/default (39) Failed to authenticate the user. (39) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40)
So don't set the Auth-Type... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
But I get this on using Cleartext-Password. MariaDB [radius]> select * from radcheck where username='test'; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | test | Auth-Type | := | Local | | 2 | test | Cleartext-Password | := | test | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec) -----Original Message----- From: freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org [mailto:freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Wednesday, November 19, 2014 9:11 PM To: FreeRadius users mailing list Subject: Re: Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
On 19 Nov 2014, at 10:28, Karuppasamy, Senthil <skaruppasamy@extremenetworks.com> wrote:
Thanks for the quick reply. It worked but am still getting an access reject in the authenticate section :
(3) Found Auth-Type = Local (3) # Executing section authenticate from file /etc/raddb/sites-enabled/default (3) Failed to authenticate the user. (3) Login incorrect: [test/test] (from client DUT1 port 0 cli 10.120.92.40)
Am I missing something here ? Shouldn't Auth-Type as Local mean that he validates it against the username in the radcheck table ( namely test in this case ) ?
Yeah, you're missing the fact that he's used an unknown attribute in the previous row. "Password" is not a FreeRADIUS attribute. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
Karuppasamy, Senthil wrote:
But I get this on using Cleartext-Password.
MariaDB [radius]> select * from radcheck where username='test'; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | test | Auth-Type | := | Local |
Delete that row. It's not necessary. All of the documentation says to NOT do that. Alan DeKok.
Thanks you very much for the instant help. It works perfectly now. Senthil KSK -----Original Message----- From: freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org [mailto:freeradius-users-bounces+skaruppasamy=extremenetworks.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 19, 2014 9:32 PM To: FreeRadius users mailing list Subject: Re: Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password" Karuppasamy, Senthil wrote:
But I get this on using Cleartext-Password.
MariaDB [radius]> select * from radcheck where username='test'; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | test | Auth-Type | := | Local |
Delete that row. It's not necessary. All of the documentation says to NOT do that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
On Wed, Nov 19, 2014 at 03:48:59PM +0000, Karuppasamy, Senthil wrote:
But I get this on using Cleartext-Password.
MariaDB [radius]> select * from radcheck where username='test'; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | test | Auth-Type | := | Local |
Don't set Auth-Type. In 99% of cases the server is clever enough to work it out on its own. And 'Local' is not correct these days anyhow. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Karuppasamy, Senthil -
Matthew Newton