LDAP group-checking - missing user-dn in filter
This morning I'm attempting to upgrade my FreeRadius install from 1.1.7 to 2.0.5. I'm having an issue with LDAP group-checking. Here's my scenario: I authenticate users with LDAP (eDirectory). In addition, I do some LDAP group-checking to determine which RADIUS attributes I want to return to the network device. This happens in the "users" file, with lines like: DEFAULT Ldap-Group == students Aruba-User-Role = student DEFAULT Ldap-Group == employees Aruba-User-Role = employee This was working in 1.1.7. But now I'm on 2.0.5, and after converting the config files, this is how it is behaving: users: Matched entry DEFAULT at line 13 rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=person)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.messiah.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radius2/etc/raddb/certs/messiah-ca.crt rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=ldap-radius,o=mc/*** to ldap.messiah.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in t=mc-tree, with filter (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=students)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group students not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=employees)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() ++[files] returns ok I can see the issue here... the filter is messed up. expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=). Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration... Jason
Jason Long wrote:
expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=))
The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=).
Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration...
In 2.0.5, it's been moved to %{control:LDAP-UserDn}. This should be better documented... Alan DeKok.
Alan DeKok <aland@deployingradius.com> 8/18/08 12:02 PM >>> Jason Long wrote: expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=))
The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=).
Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration...
In 2.0.5, it's been moved to %{control:LDAP-UserDn}. This should be better documented...
That did it. It's now working for me. Thanks so much! (I'll follow-up with a patch for the documentation.) Jason
When I upgraded from 1.1.7 to 2.0.5, my group-checking rules stopped working. By running FreeRadius in debug mode, I noticed that the filters it was constructing to do the group-membership check were incorrect. My configuration had this (in modules/ldap): groupmembership_filter = "(&(objectClass=groupOfNames)(member=%{Ldap-UserDn}))" But the debug output had this: expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) Apparently, in this version, the syntax of %{Ldap-UserDn} should now be %{control:Ldap-UserDn}. Thanks to Alan DeKok for letting me know. I have verified that this worked. The attached patch updates the documentation to show the correct syntax, and fixes the default value in rlm_ldap.c. --- doc/rlm_ldap | 4 ++-- raddb/modules/ldap | 2 +- src/modules/rlm_ldap/rlm_ldap.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/rlm_ldap b/doc/rlm_ldap index 32f7e8e..56467b6 100644 --- a/doc/rlm_ldap +++ b/doc/rlm_ldap @@ -232,9 +232,9 @@ the rlm_ldap module: # groupmembership_filter: The filter to search for group membership of a # particular user after we have found the DN for the group. # -# default: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) +# default: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) # -# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" +# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute: The attribute in the user entry that states diff --git a/raddb/modules/ldap b/raddb/modules/ldap index 1f0ff88..a330214 100644 --- a/raddb/modules/ldap +++ b/raddb/modules/ldap @@ -126,7 +126,7 @@ ldap { # Group membership checking. Disabled by default. # # groupname_attribute = cn - # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" + # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index b127417..bb2be91 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -280,7 +280,7 @@ static const CONF_PARSER module_config[] = { {"groupname_attribute", PW_TYPE_STRING_PTR, offsetof(ldap_instance,groupname_attr), NULL, "cn"}, {"groupmembership_filter", PW_TYPE_STRING_PTR, - offsetof(ldap_instance,groupmemb_filt), NULL, "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"}, + offsetof(ldap_instance,groupmemb_filt), NULL, "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"}, {"groupmembership_attribute", PW_TYPE_STRING_PTR, offsetof(ldap_instance,groupmemb_attr), NULL, NULL},
participants (2)
-
Alan DeKok -
Jason Long