On 07/04/2015 03:17 AM, stefan nowak wrote:

Hi All,

since few days I've stocked with configuration freeradius. All works good except one thing. I can't get info from Active Directory to freeradius in which group user belong (this one I need to set vlan depend on group). My version freeradius is 3.0.4

as you can see below user "newuser" participate in group "computers", here`s output from ldapsearch:

dn: CN=newuser,CN=Users,DC=test,DC=ad,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: newuser givenName: newuser distinguishedName: CN=newuser,CN=Users,DC=test,DC=ad,DC=com instanceType: 4 whenCreated: 20150702132126.0Z whenChanged: 20150703105127.0Z displayName: newuser uSNCreated: 82039 memberOf: CN=computers,CN=Users,DC=test,DC=ad,DC=com uSNChanged: 90187 name: newuser objectGUID:: XX+6g4wMJEGdDfEOZF5Rgw== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 pwdLastSet: 130803168865078125 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAR3zVX0Ki+LP5AMXOVQQAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: newuser sAMAccountType: 805306368 userPrincipalName: newuser@test.ad.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=test,DC=ad,DC=com dSCorePropagationData: 16010101000000.0Z lastLogonTimestamp: 130803172388710937

from log output I see that user "newuser" get access-accept but freeradius didn`t find him in group "computers" here is output:

Received Access-Request Id 182 from 192.168.0.2:1812 to 192.168.0.10:1812 length 129 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000c016e657775736572 Message-Authenticator = 0x4331712c3046bdcd9eb1614539cc6375 (0) Received Access-Request packet from host 192.168.0.2 port 1812, id=182, length=129 (0) NAS-IP-Address = 192.168.0.2 (0) NAS-Port = 50024 (0) NAS-Port-Type = Ethernet (0) User-Name = 'newuser' (0) Called-Station-Id = '00-16-9D-D3-40-D8' (0) Calling-Station-Id = '68-B5-99-C8-B0-5E' (0) Service-Type = Framed-User (0) Framed-MTU = 1500 (0) EAP-Message = 0x0200000c016e657775736572 (0) Message-Authenticator = 0x4331712c3046bdcd9eb1614539cc6375 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /@\\./) (0) if (&User-Name =~ /@\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "newuser", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : Peer sent code Response (2) ID 0 length 12 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent method Identity (1) (0) eap : Calling eap_peap to process EAP data (0) eap_peap : Flushing SSL sessions (of #0) (0) eap_peap : Initiate (0) eap_peap : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0x0e9027300e913e66 (0) [eap] = handled (0) } # authenticate = handled (0) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=182, length=0 (0) EAP-Message = 0x010100061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x0e9027300e913e6603c734ef610afcab Sending Access-Challenge Id 182 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e9027300e913e6603c734ef610afcab (0) Finished request Waking up in 0.3 seconds. Received Access-Request Id 183 from 192.168.0.2:1812 to 192.168.0.10:1812 length 276 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e9027300e913e6603c734ef610afcab EAP-Message = 0x0201008d198000000083160301007e0100007a0301559664033b1b4862038b2d1367a8d5b31031ef49921dca1e46e5720f5b2fa8f320fa4af0c0ab28637bf7d426826fc4d55981527e8e975dcc90dc4e38e9fbae1d940018002f00350005000ac013c014c009c00a003200380013000401000019ff01000100000a0006000400170018000b0002010000230000 Message-Authenticator = 0x266af039e3fea82832098be1d93cc75f (1) Received Access-Request packet from host 192.168.0.2 port 1812, id=183, length=276 (1) NAS-IP-Address = 192.168.0.2 (1) NAS-Port = 50024 (1) NAS-Port-Type = Ethernet (1) User-Name = 'newuser' (1) Called-Station-Id = '00-16-9D-D3-40-D8' (1) Calling-Station-Id = '68-B5-99-C8-B0-5E' (1) Service-Type = Framed-User (1) Framed-MTU = 1500 (1) State = 0x0e9027300e913e6603c734ef610afcab (1) EAP-Message = 0x0201008d198000000083160301007e0100007a0301559664033b1b4862038b2d1367a8d5b31031ef49921dca1e46e5720f5b2fa8f320fa4af0c0ab28637bf7d426826fc4d55981527e8e975dcc90dc4e38e9fbae1d940018002f00350005000ac013c014c009c00a003200380013000401000019ff01000100000a0006000400170018000b0002010000230000 (1) Message-Authenticator = 0x266af039e3fea82832098be1d93cc75f (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) if (!&User-Name) (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\\.\\./ ) (1) if (&User-Name =~ /\\.\\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\\.$/) (1) if (&User-Name =~ /\\.$/) -> FALSE (1) if (&User-Name =~ /@\\./) (1) if (&User-Name =~ /@\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : Checking for suffix after "@" (1) suffix : No '@' in User-Name = "newuser", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : Peer sent code Response (2) ID 1 length 141 (1) eap : Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0x0e9027300e913e66 (1) eap : Finished EAP session with state 0x0e9027300e913e66 (1) eap : Previous EAP request found for state 0x0e9027300e913e66, released from the list (1) eap : Peer sent method PEAP (25) (1) eap : EAP PEAP (25) (1) eap : Calling eap_peap to process EAP data (1) eap_peap : processing EAP-TLS TLS Length 131 (1) eap_peap : Length Included (1) eap_peap : eaptls_verify returned 11 (1) eap_peap : (other): before/accept initialization (1) eap_peap : TLS_accept: before/accept initialization (1) eap_peap : <<< TLS 1.0 Handshake [length 007e], ClientHello SSL: Client requested cached session fa4af0c0ab28637bf7d426826fc4d55981527e8e975dcc90dc4e38e9fbae1d94 (1) eap_peap : TLS_accept: SSLv3 read client hello A (1) eap_peap : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) eap_peap : TLS_accept: SSLv3 write server hello A (1) eap_peap : >>> TLS 1.0 Handshake [length 08d0], Certificate (1) eap_peap : TLS_accept: SSLv3 write certificate A (1) eap_peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_peap : TLS_accept: SSLv3 write server done A (1) eap_peap : TLS_accept: SSLv3 flush data (1) eap_peap : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) eap_peap : eaptls_process returned 13 (1) eap_peap : FR_TLS_HANDLED (1) eap : New EAP session, adding 'State' attribute to reply 0x0e9027300f923e66 (1) [eap] = handled (1) } # authenticate = handled (1) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=183, length=0 (1) EAP-Message = 0x010203ec19c00000093416030100510200004d030155967fdd334b8b93e13aaba983cf708cc59b52a195fa942852b7eb85c9e6b3132048fd8119fa32c7cb48b60449437ed3f1edad01e5ff81191e7be8d62b3e5f17c4002f000005ff0100010016030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d01010b0500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303632333039323031315a170d3135303832323039323031315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cb6b06d9bfe3e7b3b07012c1ffbeb410e02e9a2c (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x0e9027300f923e6603c734ef610afcab Sending Access-Challenge Id 183 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x010203ec19c00000093416030100510200004d030155967fdd334b8b93e13aaba983cf708cc59b52a195fa942852b7eb85c9e6b3132048fd8119fa32c7cb48b60449437ed3f1edad01e5ff81191e7be8d62b3e5f17c4002f000005ff0100010016030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d01010b0500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303632333039323031315a170d3135303832323039323031315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cb6b06d9bfe3e7b3b07012c1ffbeb410e02e9a2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e9027300f923e6603c734ef610afcab (1) Finished request Waking up in 0.3 seconds. Received Access-Request Id 184 from 192.168.0.2:1812 to 192.168.0.10:1812 length 141 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e9027300f923e6603c734ef610afcab EAP-Message = 0x020200061900 Message-Authenticator = 0x8f82b650b4b634e464ffc5f8d5f78feb (2) Received Access-Request packet from host 192.168.0.2 port 1812, id=184, length=141 (2) NAS-IP-Address = 192.168.0.2 (2) NAS-Port = 50024 (2) NAS-Port-Type = Ethernet (2) User-Name = 'newuser' (2) Called-Station-Id = '00-16-9D-D3-40-D8' (2) Calling-Station-Id = '68-B5-99-C8-B0-5E' (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) State = 0x0e9027300f923e6603c734ef610afcab (2) EAP-Message = 0x020200061900 (2) Message-Authenticator = 0x8f82b650b4b634e464ffc5f8d5f78feb (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) if (!&User-Name) (2) if (!&User-Name) -> FALSE (2) if (&User-Name =~ / /) (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@.*@/ ) (2) if (&User-Name =~ /@.*@/ ) -> FALSE (2) if (&User-Name =~ /\\.\\./ ) (2) if (&User-Name =~ /\\.\\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\\.$/) (2) if (&User-Name =~ /\\.$/) -> FALSE (2) if (&User-Name =~ /@\\./) (2) if (&User-Name =~ /@\\./) -> FALSE (2) } # filter_username filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : Checking for suffix after "@" (2) suffix : No '@' in User-Name = "newuser", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) eap : Peer sent code Response (2) ID 2 length 6 (2) eap : Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) authenticate { (2) eap : Expiring EAP session with state 0x0e9027300f923e66 (2) eap : Finished EAP session with state 0x0e9027300f923e66 (2) eap : Previous EAP request found for state 0x0e9027300f923e66, released from the list (2) eap : Peer sent method PEAP (25) (2) eap : EAP PEAP (25) (2) eap : Calling eap_peap to process EAP data (2) eap_peap : processing EAP-TLS (2) eap_peap : Received TLS ACK (2) eap_peap : Received TLS ACK (2) eap_peap : ACK handshake fragment handler (2) eap_peap : eaptls_verify returned 1 (2) eap_peap : eaptls_process returned 13 (2) eap_peap : FR_TLS_HANDLED (2) eap : New EAP session, adding 'State' attribute to reply 0x0e9027300c933e66 (2) [eap] = handled (2) } # authenticate = handled (2) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=184, length=0 (2) EAP-Message = 0x010303e819405dadee37810b310ed26be4bf84d74c93ed4bec31d3134bb7a82b63f7c127649298b74b8aaa1cb9fcc7f38620180bc143afd04d038ef800534cc721eb60db5cbc61c6b9b07e52b2be16b702215ff87201c227e511bc39694982461c2d21008a4b0a0004e5308204e1308203c9a003020102020900d341ec42790a6fe5300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303632333039323031315a170d3135303832323039323031315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x0e9027300c933e6603c734ef610afcab Sending Access-Challenge Id 184 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x010303e819405dadee37810b310ed26be4bf84d74c93ed4bec31d3134bb7a82b63f7c127649298b74b8aaa1cb9fcc7f38620180bc143afd04d038ef800534cc721eb60db5cbc61c6b9b07e52b2be16b702215ff87201c227e511bc39694982461c2d21008a4b0a0004e5308204e1308203c9a003020102020900d341ec42790a6fe5300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303632333039323031315a170d3135303832323039323031315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f00308 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e9027300c933e6603c734ef610afcab (2) Finished request Waking up in 0.3 seconds. Received Access-Request Id 185 from 192.168.0.2:1812 to 192.168.0.10:1812 length 141 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e9027300c933e6603c734ef610afcab EAP-Message = 0x020300061900 Message-Authenticator = 0x4612243013b59207a7128ea3f82af7c3 (3) Received Access-Request packet from host 192.168.0.2 port 1812, id=185, length=141 (3) NAS-IP-Address = 192.168.0.2 (3) NAS-Port = 50024 (3) NAS-Port-Type = Ethernet (3) User-Name = 'newuser' (3) Called-Station-Id = '00-16-9D-D3-40-D8' (3) Calling-Station-Id = '68-B5-99-C8-B0-5E' (3) Service-Type = Framed-User (3) Framed-MTU = 1500 (3) State = 0x0e9027300c933e6603c734ef610afcab (3) EAP-Message = 0x020300061900 (3) Message-Authenticator = 0x4612243013b59207a7128ea3f82af7c3 (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) filter_username filter_username { (3) if (!&User-Name) (3) if (!&User-Name) -> FALSE (3) if (&User-Name =~ / /) (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@.*@/ ) (3) if (&User-Name =~ /@.*@/ ) -> FALSE (3) if (&User-Name =~ /\\.\\./ ) (3) if (&User-Name =~ /\\.\\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\\.$/) (3) if (&User-Name =~ /\\.$/) -> FALSE (3) if (&User-Name =~ /@\\./) (3) if (&User-Name =~ /@\\./) -> FALSE (3) } # filter_username filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : Checking for suffix after "@" (3) suffix : No '@' in User-Name = "newuser", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) eap : Peer sent code Response (2) ID 3 length 6 (3) eap : Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/raddb/sites-enabled/default (3) authenticate { (3) eap : Expiring EAP session with state 0x0e9027300c933e66 (3) eap : Finished EAP session with state 0x0e9027300c933e66 (3) eap : Previous EAP request found for state 0x0e9027300c933e66, released from the list (3) eap : Peer sent method PEAP (25) (3) eap : EAP PEAP (25) (3) eap : Calling eap_peap to process EAP data (3) eap_peap : processing EAP-TLS (3) eap_peap : Received TLS ACK (3) eap_peap : Received TLS ACK (3) eap_peap : ACK handshake fragment handler (3) eap_peap : eaptls_verify returned 1 (3) eap_peap : eaptls_process returned 13 (3) eap_peap : FR_TLS_HANDLED (3) eap : New EAP session, adding 'State' attribute to reply 0x0e9027300d943e66 (3) [eap] = handled (3) } # authenticate = handled (3) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=185, length=0 (3) EAP-Message = 0x0104017619007479820900d341ec42790a6fe5300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010505000382010100ac39c26dec50bba63993d15c97f83ed294499bc6f92436a1b253966ce768d892d9c68aae360018347c9c54833061317e8c1768250d6cccc4adcf063a0e86c81dc9cff914de4d42cf06568494ce9ee4ae6852654d5160cabfe64f82e2ffea66c370698f88f72345954429fe25a91d10626e004dccc58a222bdae41daf083ca5259bae8f896a62454d37d648ca30dcde05f947866efc0ed7d73e7671954218729559ea417e6300a28cb165d68d2591e811118edd483888e77ab2695dde4c325340ea840f56fb31837fcf733069a89ed1f320b33a95572350fda6a7fbcfa850c719334e496b5ae294ee8769b9617ae8bf7830c86e79e0628d25a49a7a7afa6471ab16030100040e000000 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x0e9027300d943e6603c734ef610afcab Sending Access-Challenge Id 185 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x0104017619007479820900d341ec42790a6fe5300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010505000382010100ac39c26dec50bba63993d15c97f83ed294499bc6f92436a1b253966ce768d892d9c68aae360018347c9c54833061317e8c1768250d6cccc4adcf063a0e86c81dc9cff914de4d42cf06568494ce9ee4ae6852654d5160cabfe64f82e2ffea66c370698f88f72345954429fe25a91d10626e004dccc58a222bdae41daf083ca5259bae8f896a62454d37d648ca30dcde05f947866efc0ed7d73e7671954218729559ea417e6300a28cb165d68d2591e811118edd483888e77ab2695dde4c325340ea840f56fb31837fcf733069a89ed1f320b33a95572350fda6a7fbcfa850c719334e496b5ae294ee8769b9617ae8bf7830c86e79e0628d25a49a7a7afa6471ab16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e9027300d943e6603c734ef610afcab (3) Finished request Waking up in 0.2 seconds. Received Access-Request Id 186 from 192.168.0.2:1812 to 192.168.0.10:1812 length 473 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e9027300d943e6603c734ef610afcab EAP-Message = 0x0204015019800000014616030101061000010201009c140457a5001869d3c4409886b6381ffbb3a3b2e588b5c1a8d432a0577faee12a585e5772dcbbcd7f54d7841cd2ef3c4241655a7ecca77efe6bbb11ef29698031973a611a05c0f2da4e21b11aec38e086460f2218cfa58a027596405e8a0b1e608f06424528ac7c978de90b5c6cb179a2d9e3eb016a85cd20e2d43c142a0af7a4b00f6e57348fe41e154b44a604fbf973d99b09af607f745a2045874f5870b878f1bfccfa1b5219a0cb60ad9bb7dca77628afeee09efe1b394bbbecff907c0e5b23bd8622b38a360cde10bf3bb568ba3e577b78a9e793d9204e5188976028b9873709604f2a1272a978745544efe39db3a4ceecf16dbab756ca4e7419a14e621403010001011603010030193a998b6522faa35707604a4ba153d81f0838c651a0a8f14679c6507654ef48ef301afcfcca06e70df0f907841c7cbd Message-Authenticator = 0x1b895bbbb9e7981ab29d96346a062a54 (4) Received Access-Request packet from host 192.168.0.2 port 1812, id=186, length=473 (4) NAS-IP-Address = 192.168.0.2 (4) NAS-Port = 50024 (4) NAS-Port-Type = Ethernet (4) User-Name = 'newuser' (4) Called-Station-Id = '00-16-9D-D3-40-D8' (4) Calling-Station-Id = '68-B5-99-C8-B0-5E' (4) Service-Type = Framed-User (4) Framed-MTU = 1500 (4) State = 0x0e9027300d943e6603c734ef610afcab (4) EAP-Message = 0x0204015019800000014616030101061000010201009c140457a5001869d3c4409886b6381ffbb3a3b2e588b5c1a8d432a0577faee12a585e5772dcbbcd7f54d7841cd2ef3c4241655a7ecca77efe6bbb11ef29698031973a611a05c0f2da4e21b11aec38e086460f2218cfa58a027596405e8a0b1e608f06424528ac7c978de90b5c6cb179a2d9e3eb016a85cd20e2d43c142a0af7a4b00f6e57348fe41e154b44a604fbf973d99b09af607f745a2045874f5870b878f1bfccfa1b5219a0cb60ad9bb7dca77628afeee09efe1b394bbbecff907c0e5b23bd8622b38a360cde10bf3bb568ba3e577b78a9e793d9204e5188976028b9873709604f2a1272a978745544efe39db3a4ceecf16dbab756ca4e7419a14e621403010001011603010030193a998b6522faa35707604a4ba153d81f0838c651a0a8f14679c6507654ef48ef301afcfcca06e70df0f907841c7cbd (4) Message-Authenticator = 0x1b895bbbb9e7981ab29d96346a062a54 (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4) authorize { (4) filter_username filter_username { (4) if (!&User-Name) (4) if (!&User-Name) -> FALSE (4) if (&User-Name =~ / /) (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@.*@/ ) (4) if (&User-Name =~ /@.*@/ ) -> FALSE (4) if (&User-Name =~ /\\.\\./ ) (4) if (&User-Name =~ /\\.\\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (4) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\\.$/) (4) if (&User-Name =~ /\\.$/) -> FALSE (4) if (&User-Name =~ /@\\./) (4) if (&User-Name =~ /@\\./) -> FALSE (4) } # filter_username filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : Checking for suffix after "@" (4) suffix : No '@' in User-Name = "newuser", looking up realm NULL (4) suffix : No such realm "NULL" (4) [suffix] = noop (4) eap : Peer sent code Response (2) ID 4 length 336 (4) eap : Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/raddb/sites-enabled/default (4) authenticate { (4) eap : Expiring EAP session with state 0x0e9027300d943e66 (4) eap : Finished EAP session with state 0x0e9027300d943e66 (4) eap : Previous EAP request found for state 0x0e9027300d943e66, released from the list (4) eap : Peer sent method PEAP (25) (4) eap : EAP PEAP (25) (4) eap : Calling eap_peap to process EAP data (4) eap_peap : processing EAP-TLS TLS Length 326 (4) eap_peap : Length Included (4) eap_peap : eaptls_verify returned 11 (4) eap_peap : <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange (4) eap_peap : TLS_accept: SSLv3 read client key exchange A (4) eap_peap : <<< TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_peap : <<< TLS 1.0 Handshake [length 0010], Finished (4) eap_peap : TLS_accept: SSLv3 read finished A (4) eap_peap : >>> TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_peap : TLS_accept: SSLv3 write change cipher spec A (4) eap_peap : >>> TLS 1.0 Handshake [length 0010], Finished (4) eap_peap : TLS_accept: SSLv3 write finished A (4) eap_peap : TLS_accept: SSLv3 flush data SSL: adding session 48fd8119fa32c7cb48b60449437ed3f1edad01e5ff81191e7be8d62b3e5f17c4 to cache (4) eap_peap : (other): SSL negotiation finished successfully SSL Connection Established (4) eap_peap : eaptls_process returned 13 (4) eap_peap : FR_TLS_HANDLED (4) eap : New EAP session, adding 'State' attribute to reply 0x0e9027300a953e66 (4) [eap] = handled (4) } # authenticate = handled (4) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=186, length=0 (4) EAP-Message = 0x0105004119001403010001011603010030aae4f10e97ee19adae53413d9aa1d8d43c053c8d9e737783e7b55e6ba93fe09df382bb6903423cc0a3e1e7c0d7581e6f (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x0e9027300a953e6603c734ef610afcab Sending Access-Challenge Id 186 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x0105004119001403010001011603010030aae4f10e97ee19adae53413d9aa1d8d43c053c8d9e737783e7b55e6ba93fe09df382bb6903423cc0a3e1e7c0d7581e6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e9027300a953e6603c734ef610afcab (4) Finished request Waking up in 0.2 seconds. Received Access-Request Id 187 from 192.168.0.2:1812 to 192.168.0.10:1812 length 141 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e9027300a953e6603c734ef610afcab EAP-Message = 0x020500061900 Message-Authenticator = 0xdac0ce591021e82f7d39f28aef2399d2 (5) Received Access-Request packet from host 192.168.0.2 port 1812, id=187, length=141 (5) NAS-IP-Address = 192.168.0.2 (5) NAS-Port = 50024 (5) NAS-Port-Type = Ethernet (5) User-Name = 'newuser' (5) Called-Station-Id = '00-16-9D-D3-40-D8' (5) Calling-Station-Id = '68-B5-99-C8-B0-5E' (5) Service-Type = Framed-User (5) Framed-MTU = 1500 (5) State = 0x0e9027300a953e6603c734ef610afcab (5) EAP-Message = 0x020500061900 (5) Message-Authenticator = 0xdac0ce591021e82f7d39f28aef2399d2 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) if (!&User-Name) (5) if (!&User-Name) -> FALSE (5) if (&User-Name =~ / /) (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@.*@/ ) (5) if (&User-Name =~ /@.*@/ ) -> FALSE (5) if (&User-Name =~ /\\.\\./ ) (5) if (&User-Name =~ /\\.\\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (5) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\\.$/) (5) if (&User-Name =~ /\\.$/) -> FALSE (5) if (&User-Name =~ /@\\./) (5) if (&User-Name =~ /@\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : Checking for suffix after "@" (5) suffix : No '@' in User-Name = "newuser", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : Peer sent code Response (2) ID 5 length 6 (5) eap : Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0x0e9027300a953e66 (5) eap : Finished EAP session with state 0x0e9027300a953e66 (5) eap : Previous EAP request found for state 0x0e9027300a953e66, released from the list (5) eap : Peer sent method PEAP (25) (5) eap : EAP PEAP (25) (5) eap : Calling eap_peap to process EAP data (5) eap_peap : processing EAP-TLS (5) eap_peap : Received TLS ACK (5) eap_peap : Received TLS ACK (5) eap_peap : ACK handshake is finished (5) eap_peap : eaptls_verify returned 3 (5) eap_peap : eaptls_process returned 3 (5) eap_peap : FR_TLS_SUCCESS (5) eap_peap : Session established. Decoding tunneled attributes (5) eap_peap : Peap state TUNNEL ESTABLISHED (5) eap : New EAP session, adding 'State' attribute to reply 0x0e9027300b963e66 (5) [eap] = handled (5) } # authenticate = handled (5) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=187, length=0 (5) EAP-Message = 0x0106002b190017030100201ac493daff282d88bd079004b7a4124bc4a88fcee422591647b8a0784b2254a6 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x0e9027300b963e6603c734ef610afcab Sending Access-Challenge Id 187 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x0106002b190017030100201ac493daff282d88bd079004b7a4124bc4a88fcee422591647b8a0784b2254a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e9027300b963e6603c734ef610afcab (5) Finished request Waking up in 0.2 seconds. Received Access-Request Id 188 from 192.168.0.2:1812 to 192.168.0.10:1812 length 178 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e9027300b963e6603c734ef610afcab EAP-Message = 0x0206002b19001703010020a4f998f13de99ca28ef10b62394a61c9b1a25d73a60b123f5ad5f64fdd887c6a Message-Authenticator = 0x1794290733e67632bc38f2f4aa840390 (6) Received Access-Request packet from host 192.168.0.2 port 1812, id=188, length=178 (6) NAS-IP-Address = 192.168.0.2 (6) NAS-Port = 50024 (6) NAS-Port-Type = Ethernet (6) User-Name = 'newuser' (6) Called-Station-Id = '00-16-9D-D3-40-D8' (6) Calling-Station-Id = '68-B5-99-C8-B0-5E' (6) Service-Type = Framed-User (6) Framed-MTU = 1500 (6) State = 0x0e9027300b963e6603c734ef610afcab (6) EAP-Message = 0x0206002b19001703010020a4f998f13de99ca28ef10b62394a61c9b1a25d73a60b123f5ad5f64fdd887c6a (6) Message-Authenticator = 0x1794290733e67632bc38f2f4aa840390 (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (!&User-Name) (6) if (!&User-Name) -> FALSE (6) if (&User-Name =~ / /) (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@.*@/ ) (6) if (&User-Name =~ /@.*@/ ) -> FALSE (6) if (&User-Name =~ /\\.\\./ ) (6) if (&User-Name =~ /\\.\\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (6) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\\.$/) (6) if (&User-Name =~ /\\.$/) -> FALSE (6) if (&User-Name =~ /@\\./) (6) if (&User-Name =~ /@\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "newuser", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : Peer sent code Response (2) ID 6 length 43 (6) eap : Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { (6) eap : Expiring EAP session with state 0x0e9027300b963e66 (6) eap : Finished EAP session with state 0x0e9027300b963e66 (6) eap : Previous EAP request found for state 0x0e9027300b963e66, released from the list (6) eap : Peer sent method PEAP (25) (6) eap : EAP PEAP (25) (6) eap : Calling eap_peap to process EAP data (6) eap_peap : processing EAP-TLS (6) eap_peap : eaptls_verify returned 7 (6) eap_peap : Done initial handshake (6) eap_peap : eaptls_process returned 7 (6) eap_peap : FR_TLS_OK (6) eap_peap : Session established. Decoding tunneled attributes (6) eap_peap : Peap state WAITING FOR INNER IDENTITY (6) eap_peap : Identity - newuser (6) eap_peap : Got inner identity 'newuser' (6) eap_peap : Setting default EAP type for tunneled EAP session (6) eap_peap : Got tunneled request EAP-Message = 0x0206000c016e657775736572 server default { (6) eap_peap : Setting User-Name to newuser Sending tunneled request EAP-Message = 0x0206000c016e657775736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'newuser' NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 Event-Timestamp = 'Jul 3 2015 14:28:13 CEST' server inner-tunnel { (6) server inner-tunnel { (6) Request: EAP-Message = 0x0206000c016e657775736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'newuser' NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 Event-Timestamp = 'Jul 3 2015 14:28:13 CEST' (6) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) [chap] = noop (6) [mschap] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "newuser", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) update control { (6) Proxy-To-Realm := 'LOCAL' (6) } # update control = noop (6) eap : Peer sent code Response (2) ID 6 length 12 (6) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6) authenticate { (6) eap : Peer sent method Identity (1) (6) eap : Calling eap_mschapv2 to process EAP data (6) eap_mschapv2 : Issuing Challenge (6) eap : New EAP session, adding 'State' attribute to reply 0x51469e48514184c8 (6) [eap] = handled (6) } # authenticate = handled (6) Reply: EAP-Message = 0x010700211a0107001c10cfe19b93b6199ab73e048317618488706e657775736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51469e48514184c89c06397edfb2b9f6 (6) } # server inner-tunnel } # server inner-tunnel (6) eap_peap : Got tunneled reply code 11 EAP-Message = 0x010700211a0107001c10cfe19b93b6199ab73e048317618488706e657775736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51469e48514184c89c06397edfb2b9f6 (6) eap_peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x010700211a0107001c10cfe19b93b6199ab73e048317618488706e657775736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51469e48514184c89c06397edfb2b9f6 (6) eap_peap : Got tunneled Access-Challenge (6) eap : New EAP session, adding 'State' attribute to reply 0x0e90273008973e66 (6) [eap] = handled (6) } # authenticate = handled (6) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=188, length=0 (6) EAP-Message = 0x0107004b190017030100407520c1faa1ff4cfd7a594b2669343aa993d4447045db39c0c1ef6a3af3fa94dd9b822e84eb8895730f1cabf76bc5593ee24398478a98364b6b52fd05dfd32c0a (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x0e90273008973e6603c734ef610afcab Sending Access-Challenge Id 188 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x0107004b190017030100407520c1faa1ff4cfd7a594b2669343aa993d4447045db39c0c1ef6a3af3fa94dd9b822e84eb8895730f1cabf76bc5593ee24398478a98364b6b52fd05dfd32c0a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e90273008973e6603c734ef610afcab (6) Finished request Waking up in 0.2 seconds. Received Access-Request Id 189 from 192.168.0.2:1812 to 192.168.0.10:1812 length 242 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e90273008973e6603c734ef610afcab EAP-Message = 0x0207006b19001703010060daa946c75fc076c70e3dee92725c9fd0e09e9b31f3e9b03e995463f030c9fcacaba7ef76b8890a117b40a4868e689f211491596b2e6acc7481a01ca4d9877415d99f18815dbd2879bca03fa940e258a486def5b5f08936eeade1d0f07ba9abfb Message-Authenticator = 0x0c5af9b3231d04ec974f138a62c938b7 (7) Received Access-Request packet from host 192.168.0.2 port 1812, id=189, length=242 (7) NAS-IP-Address = 192.168.0.2 (7) NAS-Port = 50024 (7) NAS-Port-Type = Ethernet (7) User-Name = 'newuser' (7) Called-Station-Id = '00-16-9D-D3-40-D8' (7) Calling-Station-Id = '68-B5-99-C8-B0-5E' (7) Service-Type = Framed-User (7) Framed-MTU = 1500 (7) State = 0x0e90273008973e6603c734ef610afcab (7) EAP-Message = 0x0207006b19001703010060daa946c75fc076c70e3dee92725c9fd0e09e9b31f3e9b03e995463f030c9fcacaba7ef76b8890a117b40a4868e689f211491596b2e6acc7481a01ca4d9877415d99f18815dbd2879bca03fa940e258a486def5b5f08936eeade1d0f07ba9abfb (7) Message-Authenticator = 0x0c5af9b3231d04ec974f138a62c938b7 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /@\\./) (7) if (&User-Name =~ /@\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "newuser", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : Peer sent code Response (2) ID 7 length 107 (7) eap : Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap : Expiring EAP session with state 0x51469e48514184c8 (7) eap : Finished EAP session with state 0x0e90273008973e66 (7) eap : Previous EAP request found for state 0x0e90273008973e66, released from the list (7) eap : Peer sent method PEAP (25) (7) eap : EAP PEAP (25) (7) eap : Calling eap_peap to process EAP data (7) eap_peap : processing EAP-TLS (7) eap_peap : eaptls_verify returned 7 (7) eap_peap : Done initial handshake (7) eap_peap : eaptls_process returned 7 (7) eap_peap : FR_TLS_OK (7) eap_peap : Session established. Decoding tunneled attributes (7) eap_peap : Peap state phase2 (7) eap_peap : EAP type MSCHAPv2 (26) (7) eap_peap : Got tunneled request EAP-Message = 0x020700421a0207003d31cb99020a5de6871ad851f7e89c87138000000000000000008e66b16d791423c5ff26fd315d1cd9423b9866fc53939f0e006e657775736572 server default { (7) eap_peap : Setting User-Name to newuser Sending tunneled request EAP-Message = 0x020700421a0207003d31cb99020a5de6871ad851f7e89c87138000000000000000008e66b16d791423c5ff26fd315d1cd9423b9866fc53939f0e006e657775736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'newuser' State = 0x51469e48514184c89c06397edfb2b9f6 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 Event-Timestamp = 'Jul 3 2015 14:28:13 CEST' server inner-tunnel { (7) server inner-tunnel { (7) Request: EAP-Message = 0x020700421a0207003d31cb99020a5de6871ad851f7e89c87138000000000000000008e66b16d791423c5ff26fd315d1cd9423b9866fc53939f0e006e657775736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'newuser' State = 0x51469e48514184c89c06397edfb2b9f6 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 Event-Timestamp = 'Jul 3 2015 14:28:13 CEST' (7) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) [chap] = noop (7) [mschap] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "newuser", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) Proxy-To-Realm := 'LOCAL' (7) } # update control = noop (7) eap : Peer sent code Response (2) ID 7 length 66 (7) eap : No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop rlm_ldap (ldap): Reserved connection (4) (7) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap : --> (uid=newuser) (7) ldap : EXPAND dc=test,dc=ad,dc=com (7) ldap : --> dc=test,dc=ad,dc=com (7) ldap : Performing search in 'dc=test,dc=ad,dc=com' with filter '(uid=newuser)', scope 'sub' (7) ldap : Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.test.ad.com/DC=ForestDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.test.ad.com/DC=DomainDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// test.ad.com/CN=Configuration,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (7) ldap : Search returned no results rlm_ldap (ldap): Deleting connection (4) (7) [ldap] = notfound (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Expiring EAP session with state 0x51469e48514184c8 (7) eap : Finished EAP session with state 0x51469e48514184c8 (7) eap : Previous EAP request found for state 0x51469e48514184c8, released from the list (7) eap : Peer sent method MSCHAPv2 (26) (7) eap : EAP MSCHAPv2 (26) (7) eap : Calling eap_mschapv2 to process EAP data (7) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) eap_mschapv2 : Auth-Type MS-CHAP { (7) mschap : Creating challenge hash with username: newuser (7) mschap : Client is using MS-CHAPv2 Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (7) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (7) mschap : --> --username=newuser (7) mschap : Creating challenge hash with username: newuser (7) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} (7) mschap : --> --challenge=141c75ef267aec37 (7) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (7) mschap : --> --nt-response=8e66b16d791423c5ff26fd315d1cd9423b9866fc53939f0e Program returned code (0) and output 'NT_KEY: 917FDA71960ECCF4DF81D38405F86F42' (7) mschap : Adding MS-CHAPv2 MPPE keys (7) [mschap] = ok (7) } # Auth-Type MS-CHAP = ok MSCHAP Success (7) eap : New EAP session, adding 'State' attribute to reply 0x51469e48504e84c8 (7) [eap] = handled (7) } # authenticate = handled (7) Reply: EAP-Message = 0x010800331a0307002e533d45413244333642323330373038354334373443444233383738423444393141433936393944313533 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51469e48504e84c89c06397edfb2b9f6 (7) } # server inner-tunnel } # server inner-tunnel (7) eap_peap : Got tunneled reply code 11 EAP-Message = 0x010800331a0307002e533d45413244333642323330373038354334373443444233383738423444393141433936393944313533 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51469e48504e84c89c06397edfb2b9f6 (7) eap_peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d45413244333642323330373038354334373443444233383738423444393141433936393944313533 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51469e48504e84c89c06397edfb2b9f6 (7) eap_peap : Got tunneled Access-Challenge (7) eap : New EAP session, adding 'State' attribute to reply 0x0e90273009983e66 (7) [eap] = handled (7) } # authenticate = handled (7) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=189, length=0 (7) EAP-Message = 0x0108005b19001703010050f5928f4ef2504f8111ab1eb22a3d7055f034eb84663b65bd07291d795cbd5a872c90146b2738a779cf42d7acd17f1425f25e5139936ce90ece8924c0ddf1dd6d66eb94efda5148cf5b8b62fd2f49fd5b (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x0e90273009983e6603c734ef610afcab Sending Access-Challenge Id 189 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x0108005b19001703010050f5928f4ef2504f8111ab1eb22a3d7055f034eb84663b65bd07291d795cbd5a872c90146b2738a779cf42d7acd17f1425f25e5139936ce90ece8924c0ddf1dd6d66eb94efda5148cf5b8b62fd2f49fd5b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e90273009983e6603c734ef610afcab (7) Finished request Waking up in 4.5 seconds. Received Access-Request Id 190 from 192.168.0.2:1812 to 192.168.0.10:1812 length 178 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e90273009983e6603c734ef610afcab EAP-Message = 0x0208002b19001703010020e5cacce91e4a996afb3b077c7b388bcf2f40b18a8eb5be8917a8ae01288fd33d Message-Authenticator = 0x56d20e1c3ccff86847412ce9123ecb99 (8) Received Access-Request packet from host 192.168.0.2 port 1812, id=190, length=178 (8) NAS-IP-Address = 192.168.0.2 (8) NAS-Port = 50024 (8) NAS-Port-Type = Ethernet (8) User-Name = 'newuser' (8) Called-Station-Id = '00-16-9D-D3-40-D8' (8) Calling-Station-Id = '68-B5-99-C8-B0-5E' (8) Service-Type = Framed-User (8) Framed-MTU = 1500 (8) State = 0x0e90273009983e6603c734ef610afcab (8) EAP-Message = 0x0208002b19001703010020e5cacce91e4a996afb3b077c7b388bcf2f40b18a8eb5be8917a8ae01288fd33d (8) Message-Authenticator = 0x56d20e1c3ccff86847412ce9123ecb99 (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) filter_username filter_username { (8) if (!&User-Name) (8) if (!&User-Name) -> FALSE (8) if (&User-Name =~ / /) (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@.*@/ ) (8) if (&User-Name =~ /@.*@/ ) -> FALSE (8) if (&User-Name =~ /\\.\\./ ) (8) if (&User-Name =~ /\\.\\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\\.$/) (8) if (&User-Name =~ /\\.$/) -> FALSE (8) if (&User-Name =~ /@\\./) (8) if (&User-Name =~ /@\\./) -> FALSE (8) } # filter_username filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : Checking for suffix after "@" (8) suffix : No '@' in User-Name = "newuser", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : Peer sent code Response (2) ID 8 length 43 (8) eap : Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { (8) eap : Expiring EAP session with state 0x51469e48504e84c8 (8) eap : Finished EAP session with state 0x0e90273009983e66 (8) eap : Previous EAP request found for state 0x0e90273009983e66, released from the list (8) eap : Peer sent method PEAP (25) (8) eap : EAP PEAP (25) (8) eap : Calling eap_peap to process EAP data (8) eap_peap : processing EAP-TLS (8) eap_peap : eaptls_verify returned 7 (8) eap_peap : Done initial handshake (8) eap_peap : eaptls_process returned 7 (8) eap_peap : FR_TLS_OK (8) eap_peap : Session established. Decoding tunneled attributes (8) eap_peap : Peap state phase2 (8) eap_peap : EAP type MSCHAPv2 (26) (8) eap_peap : Got tunneled request EAP-Message = 0x020800061a03 server default { (8) eap_peap : Setting User-Name to newuser Sending tunneled request EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'newuser' State = 0x51469e48504e84c89c06397edfb2b9f6 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 Event-Timestamp = 'Jul 3 2015 14:28:13 CEST' server inner-tunnel { (8) server inner-tunnel { (8) Request: EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'newuser' State = 0x51469e48504e84c89c06397edfb2b9f6 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 Event-Timestamp = 'Jul 3 2015 14:28:13 CEST' (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) [chap] = noop (8) [mschap] = noop (8) suffix : Checking for suffix after "@" (8) suffix : No '@' in User-Name = "newuser", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) update control { (8) Proxy-To-Realm := 'LOCAL' (8) } # update control = noop (8) eap : Peer sent code Response (2) ID 8 length 6 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop rlm_ldap (ldap): Reserved connection (3) (8) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap : --> (uid=newuser) (8) ldap : EXPAND dc=test,dc=ad,dc=com (8) ldap : --> dc=test,dc=ad,dc=com (8) ldap : Performing search in 'dc=test,dc=ad,dc=com' with filter '(uid=newuser)', scope 'sub' (8) ldap : Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.test.ad.com/DC=ForestDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.test.ad.com/DC=DomainDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// test.ad.com/CN=Configuration,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (8) ldap : Search returned no results rlm_ldap (ldap): Deleting connection (3) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (5) rlm_ldap (ldap): Connecting to 192.168.0.20:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (8) [ldap] = notfound (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0x51469e48504e84c8 (8) eap : Finished EAP session with state 0x51469e48504e84c8 (8) eap : Previous EAP request found for state 0x51469e48504e84c8, released from the list (8) eap : Peer sent method MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap : Freeing handler (8) [eap] = ok (8) } # authenticate = ok (8) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (8) post-auth { (8) ldap : EXPAND . (8) ldap : --> . (8) ldap : EXPAND Authenticated at %S (8) ldap : --> Authenticated at 2015-07-03 14:28:13 rlm_ldap (ldap): Reserved connection (5) (8) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap : --> (uid=newuser) (8) ldap : EXPAND dc=test,dc=ad,dc=com (8) ldap : --> dc=test,dc=ad,dc=com (8) ldap : Performing search in 'dc=test,dc=ad,dc=com' with filter '(uid=newuser)', scope 'sub' (8) ldap : Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.test.ad.com/DC=ForestDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.test.ad.com/DC=DomainDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// test.ad.com/CN=Configuration,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (8) ldap : Search returned no results rlm_ldap (ldap): Deleting connection (5) (8) [ldap] = notfound (8) } # post-auth = notfound (8) Reply: MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4 MS-MPPE-Send-Key = 0xd4fd4ee6a9d0cfb8627e5435bb5e91c9 MS-MPPE-Recv-Key = 0xd541128d165a6af4aba9ded016dce239 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'newuser' (8) } # server inner-tunnel } # server inner-tunnel (8) eap_peap : Got tunneled reply code 2 MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4 MS-MPPE-Send-Key = 0xd4fd4ee6a9d0cfb8627e5435bb5e91c9 MS-MPPE-Recv-Key = 0xd541128d165a6af4aba9ded016dce239 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'newuser' (8) eap_peap : Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4 MS-MPPE-Send-Key = 0xd4fd4ee6a9d0cfb8627e5435bb5e91c9 MS-MPPE-Recv-Key = 0xd541128d165a6af4aba9ded016dce239 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'newuser' (8) eap_peap : Tunneled authentication was successful (8) eap_peap : SUCCESS (8) eap_peap : Saving tunneled attributes for later (8) eap : New EAP session, adding 'State' attribute to reply 0x0e90273006993e66 (8) [eap] = handled (8) } # authenticate = handled (8) Sending Access-Challenge packet to host 192.168.0.2 port 1812, id=190, length=0 (8) EAP-Message = 0x0109002b1900170301002002723a75a206ea487fd592ae1b9d31d8425a2d28fb6a567b530188cd74181696 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x0e90273006993e6603c734ef610afcab Sending Access-Challenge Id 190 from 192.168.0.10:1812 to 192.168.0.2:1812 EAP-Message = 0x0109002b1900170301002002723a75a206ea487fd592ae1b9d31d8425a2d28fb6a567b530188cd74181696 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e90273006993e6603c734ef610afcab (8) Finished request Waking up in 3.8 seconds. Received Access-Request Id 191 from 192.168.0.2:1812 to 192.168.0.10:1812 length 178 NAS-IP-Address = 192.168.0.2 NAS-Port = 50024 NAS-Port-Type = Ethernet User-Name = 'newuser' Called-Station-Id = '00-16-9D-D3-40-D8' Calling-Station-Id = '68-B5-99-C8-B0-5E' Service-Type = Framed-User Framed-MTU = 1500 State = 0x0e90273006993e6603c734ef610afcab EAP-Message = 0x0209002b1900170301002092fda1c14de27079564bd73fade18792dd8f5f80adf9e4822b95949318de7efb Message-Authenticator = 0xef39ceb8bfa36750354be19a6b2ebf17 (9) Received Access-Request packet from host 192.168.0.2 port 1812, id=191, length=178 (9) NAS-IP-Address = 192.168.0.2 (9) NAS-Port = 50024 (9) NAS-Port-Type = Ethernet (9) User-Name = 'newuser' (9) Called-Station-Id = '00-16-9D-D3-40-D8' (9) Calling-Station-Id = '68-B5-99-C8-B0-5E' (9) Service-Type = Framed-User (9) Framed-MTU = 1500 (9) State = 0x0e90273006993e6603c734ef610afcab (9) EAP-Message = 0x0209002b1900170301002092fda1c14de27079564bd73fade18792dd8f5f80adf9e4822b95949318de7efb (9) Message-Authenticator = 0xef39ceb8bfa36750354be19a6b2ebf17 (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) filter_username filter_username { (9) if (!&User-Name) (9) if (!&User-Name) -> FALSE (9) if (&User-Name =~ / /) (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@.*@/ ) (9) if (&User-Name =~ /@.*@/ ) -> FALSE (9) if (&User-Name =~ /\\.\\./ ) (9) if (&User-Name =~ /\\.\\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) (9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\\.$/) (9) if (&User-Name =~ /\\.$/) -> FALSE (9) if (&User-Name =~ /@\\./) (9) if (&User-Name =~ /@\\./) -> FALSE (9) } # filter_username filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : Checking for suffix after "@" (9) suffix : No '@' in User-Name = "newuser", looking up realm NULL (9) suffix : No such realm "NULL" (9) [suffix] = noop (9) eap : Peer sent code Response (2) ID 9 length 43 (9) eap : Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap : Expiring EAP session with state 0x0e90273006993e66 (9) eap : Finished EAP session with state 0x0e90273006993e66 (9) eap : Previous EAP request found for state 0x0e90273006993e66, released from the list (9) eap : Peer sent method PEAP (25) (9) eap : EAP PEAP (25) (9) eap : Calling eap_peap to process EAP data (9) eap_peap : processing EAP-TLS (9) eap_peap : eaptls_verify returned 7 (9) eap_peap : Done initial handshake (9) eap_peap : eaptls_process returned 7 (9) eap_peap : FR_TLS_OK (9) eap_peap : Session established. Decoding tunneled attributes (9) eap_peap : Peap state send tlv success (9) eap_peap : Received EAP-TLV response (9) eap_peap : Success (9) eap_peap : Using saved attributes from the original Access-Accept User-Name = 'newuser' (9) eap_peap : Saving session 48fd8119fa32c7cb48b60449437ed3f1edad01e5ff81191e7be8d62b3e5f17c4 vps 0x7f6012aedf20 in the cache (9) eap : Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/default (9) post-auth { (9) ldap : EXPAND . (9) ldap : --> . (9) ldap : EXPAND Authenticated at %S (9) ldap : --> Authenticated at 2015-07-03 14:28:14 rlm_ldap (ldap): Reserved connection (2) (9) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (9) ldap : --> (uid=newuser) (9) ldap : EXPAND dc=test,dc=ad,dc=com (9) ldap : --> dc=test,dc=ad,dc=com (9) ldap : Performing search in 'dc=test,dc=ad,dc=com' with filter '(uid=newuser)', scope 'sub' (9) ldap : Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.test.ad.com/DC=ForestDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.test.ad.com/DC=DomainDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// test.ad.com/CN=Configuration,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (9) ldap : Search returned no results rlm_ldap (ldap): Deleting connection (2) (9) [ldap] = notfound (9) if (LDAP-Group == "cn=computers,cn=Users,dc=test,dc=ad,dc=com") (9) Searching for user in group "cn=computers,cn=Users,dc=test,dc=ad,dc=com" rlm_ldap (ldap): Reserved connection (1) (9) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (9) --> (uid=newuser) (9) EXPAND dc=test,dc=ad,dc=com (9) --> dc=test,dc=ad,dc=com (9) Performing search in 'dc=test,dc=ad,dc=com' with filter '(uid=newuser)', scope 'sub' (9) Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.test.ad.com/DC=ForestDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.test.ad.com/DC=DomainDnsZones,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// test.ad.com/CN=Configuration,DC=test,DC=ad,DC=com rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (9) Search returned no results rlm_ldap (ldap): Deleting connection (1) (9) if (LDAP-Group == "cn=computers,cn=Users,dc=test,dc=ad,dc=com") -> FALSE (9) [exec] = noop (9) remove_reply_message_if_eap remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else else { (9) [noop] = noop (9) } # else else = noop (9) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sending Access-Accept packet to host 192.168.0.2 port 1812, id=191, length=0 (9) User-Name = 'newuser' (9) MS-MPPE-Recv-Key = 0x770d0af8f17ddb90ae45050890e77a2f1284a252cb8a2dea9126d6e3ad90bda2 (9) MS-MPPE-Send-Key = 0x71f8b9b7a8aa1a90922d6043ad069e7e436ef4cce627dbd2c2e6bea252154cce (9) EAP-MSK = 0x770d0af8f17ddb90ae45050890e77a2f1284a252cb8a2dea9126d6e3ad90bda271f8b9b7a8aa1a90922d6043ad069e7e436ef4cce627dbd2c2e6bea252154cce (9) EAP-EMSK = 0x1b54d22a41027762199d0673d2024afb9b75034f4486286e1ce600f42266b87c01bf8b7801e44f136c405e7098f74a39062c8d0fd8199ad362af3aa3fd939603 (9) EAP-Session-Id = 0x19559664033b1b4862038b2d1367a8d5b31031ef49921dca1e46e5720f5b2fa8f355967fdd334b8b93e13aaba983cf708cc59b52a195fa942852b7eb85c9e6b313 (9) EAP-Message = 0x03090004 (9) Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Accept Id 191 from 192.168.0.10:1812 to 192.168.0.2:1812 User-Name = 'newuser' MS-MPPE-Recv-Key = 0x770d0af8f17ddb90ae45050890e77a2f1284a252cb8a2dea9126d6e3ad90bda2 MS-MPPE-Send-Key = 0x71f8b9b7a8aa1a90922d6043ad069e7e436ef4cce627dbd2c2e6bea252154cce EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 (9) Finished request

in ldap config file, part related user and groups looks like below:

user { base_dn = "dc=test,dc=ad,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" } group {

base_dn ="dc=test,dc=ad,dc=com" filter = "(objectClass=posixGroup)" name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = "memberOf" }

Why freeradius can't match group "computers" to user "newuser"?

I would be very glad on any help - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html your filter and membership_filter directives conflict.

the objectClass posixGroup uses the memberUid attribute, while the objectClass groupOfNames uses the member attribute. because you are using AD, it should support RFC 2307bis, which makes the posixGroup an auxiliary objectClass, and not structural. both attributes (member and memberUid) can be defined for the same object, but it is likely that only one is used. get our your favorite LDAP browser (phpLdapAdmin, gq, lat, luma, or SoftTerra LDAP Browser for windows) and look at the group object you are trying to match on. note the used attributes and adjust your filter and membership_filter directives accordingly.