No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. But when I using "radius -X" to start the radius The server shown the message : [ldap] performing user authorization for ldapuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldapuser) expand: dc=mydomain,dc=com -> dc=mydomain,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=com/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 245 to 127.0.0.1 port 33059 What's the problem ? how can I to fix the error ? Please help me! Regards, Vicky
rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser)
rlm_ldap: object not found or got ambiguous search result
[ldap] search failed
Either you don't have ldapuser or the user is not unique (there are several users with that username). Do ldapsearch and see what it returns. Ivan Kalik Kalik Informatika ISP
Hi all : When I use ldapsearch (ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)'),return as follows : # extended LDIF # # LDAPv3 # base <dc=mydomain,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # mydomain.com dn: dc=mydomain,dc=com objectClass: dcObject objectClass: organization o: network dc: mydomain # ldapuser, mydomain.com dn: cn=ldapuser,dc=mydomain,dc=com objectClass: organizationalRole cn: ldapuser # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 -----Original Message----- From: freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org [mailto:freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org] On Behalf Of tnt@kalik.net Sent: Tuesday, November 25, 2008 6:38 PM To: FreeRadius users mailing list Subject: Re: No authenticate method (Auth-Type) configuration found for therequest: Rejecting the user
rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser)
rlm_ldap: object not found or got ambiguous search result
[ldap] search failed
Either you don't have ldapuser or the user is not unique (there are several users with that username). Do ldapsearch and see what it returns. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
When I use ldapsearch (ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)'),return as follows :
Do the same search freeradius does:
rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser)
Ivan Kalik Kalik Informatika ISP
Hi ivan: Are you mean using " ldapsearch -x -b 'dc=mydomain,dc=com,uid=ldapuser' '(objectclass =*)' " ? When I using " ldapsearch -x -b 'dc=mydomain,dc=com,uid=ldapuser' '(objectclass =*)' ",then reply as follows : # extended LDIF # # LDAPv3 # base <dc=mydomain,dc=com,uid=ldapuser> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object -----Original Message----- From: freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org [mailto:freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org] On Behalf Of tnt@kalik.net Sent: Tuesday, November 25, 2008 7:44 PM To: FreeRadius users mailing list Subject: RE: No authenticate method (Auth-Type) configuration foundfor therequest: Rejecting the user
When I use ldapsearch (ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)'),return as follows :
Do the same search freeradius does:
rlm_ldap: performing search in dc=mydomain,dc=com, with filter (uid=ldapuser)
Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
# extended LDIF # # LDAPv3 # base <dc=mydomain,dc=com,uid=ldapuser> with scope subtree # filter: (objectclass=*) # requesting: ALL #
# search result search: 2 result: 32 No such object
So you don't have a user entries (uid, userPassword etc.) for ldapuser. Ivan Kalik Kalik Informatika ISP
Dear ivan: But the search results have shown "># base <dc=mydomain,dc=com,uid=ldapuser> with scope subtree". If I don't have the new entry "ldapuser", so how can I add the new entries ? Regards, vicky -----Original Message----- From: freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org [mailto:freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org] On Behalf Of tnt@kalik.net Sent: Tuesday, November 25, 2008 8:38 PM To: FreeRadius users mailing list Subject: RE: No authenticate method (Auth-Type)configuration foundfor therequest: Rejecting the user
# extended LDIF # # LDAPv3 # base <dc=mydomain,dc=com,uid=ldapuser> with scope subtree # filter: (objectclass=*) # requesting: ALL #
# search result search: 2 result: 32 No such object
So you don't have a user entries (uid, userPassword etc.) for ldapuser. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I'm fairly positive there are pointers in the documentation for your specific LDAP server on how to add data into it. //anders hsuan wrote:
Dear ivan: But the search results have shown "># base <dc=mydomain,dc=com,uid=ldapuser> with scope subtree". If I don't have the new entry "ldapuser", so how can I add the new entries ?
hsuan wrote:
But when I using “radius -X” to start the radius
You've conveniently deleted most of the debugging output.
The server shown the message : ... rlm_ldap: object not found or got ambiguous search result
Fix that. The LDAP module is not able to find the users password.
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
Because the LDAP search failed. Alan DeKok.
Dear Alan: So how can I set the ldapuser's password? -----Original Message----- From: freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org [mailto:freeradius-users-bounces+hsuan=nchc.org.tw@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, November 25, 2008 6:42 PM To: FreeRadius users mailing list Subject: Re: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user hsuan wrote:
But when I using “radius -X” to start the radius
You've conveniently deleted most of the debugging output.
The server shown the message : ... rlm_ldap: object not found or got ambiguous search result
Fix that. The LDAP module is not able to find the users password.
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
Because the LDAP search failed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Anders Holm -
hsuan -
tnt＠kalik.net