ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
Hi everyone, I need a little help because I am trying to configure a FreeRadius 3.0.12 + LDAP. With the previous FR version (2.2.5) everything work fine and I was able to authenticate my LDAP'users. Now I am trying to replicate my configuration but I receive this error: ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject My config files seem to be the same among the different FR versions. This is my debug output: (0) Received Access-Request Id 85 from MYCLIENT:47127 to MYSERVER:1812 length 86 (0) User-Name = "MYUSER" (0) User-Password = "MYPASSWORD" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0xa7d43fb7b44c2c15e704324f69e3e0d9 (0) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "MYUSER", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=MYUSER) (0) ldap: Performing search in "dc=MYCOMPANY,dc=MYDOMAIN" with filter "(uid=MYUSER)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=MYUSER,ou=people,dc= MYCOMPANY,dc=MYDOMAIN" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> MYUSER (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 85 from MYSERVER:1812 to MYCLIENT:47127 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 85 with timestamp +2 Ready to process requests What do I wrong or miss? Many thanks in advance for your help. Andrea -- Avvertenze ai sensi del D.Lgs.196 del 30/06/2003 Le informazioni contenute in questo messaggio di posta elettronica e/o files allegati, sono da considerarsi strettamente riservati. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nello stesso. Costituisce violazione ai principi dettati dal D.Lgs. 196/2003: trattenere il messaggio stesso oltre il tempo necessario, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo od utilizzarlo per finalità diverse. In ogni momento potrà richiederci la sospensione dell'impiego dei suoi dati, ad esclusione delle comunicazioni effettuate in esecuzione di obblighi di legge. Qualora avesse ricevuto questo messaggio senza esserne il destinatario La preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso dal Suo sistema. Se desidera presentare un reclamo, può trovare informazioni e supporto sul nostro sito www.widegroup.eu/reclami o può scrivere a reclami@widegroup.eu. Grazie. -- This message is confidential. It may also be privileged or otherwise protected by work, product, immunity or other legal rules. If you have received it by mistake, please let us know by e-mail reply and delete it from your system; you may not copy this message or disclose its contents to anyone. The integrity and security of this message cannot be guaranteed on the Internet. If you want to submit a formal complaint, you can find information and support on our website www.widegroup.eu/reclami or writing to reclami@widegroup.eu. Thank you.
On Sep 1, 2017, at 9:22 AM, Andrea Passuello <andrea.passuello@widegroup.eu> wrote:
With the previous FR version (2.2.5) everything work fine and I was able to authenticate my LDAP'users.
Now I am trying to replicate my configuration but I receive this error:
ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
It helps to read ALL of the debug output.
... (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=MYUSER) (0) ldap: Performing search in "dc=MYCOMPANY,dc=MYDOMAIN" with filter "(uid=MYUSER)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=MYUSER,ou=people,dc= MYCOMPANY,dc=MYDOMAIN" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
That message should be clear.
(0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
That message should also be clear. So are you using Active Directory? If so, follow the guide here: http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.
Many thanks for the reply. 2017-09-01 15:45 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Sep 1, 2017, at 9:22 AM, Andrea Passuello < andrea.passuello@widegroup.eu> wrote:
With the previous FR version (2.2.5) everything work fine and I was able to authenticate my LDAP'users.
Now I am trying to replicate my configuration but I receive this error:
ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
It helps to read ALL of the debug output.
... (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=MYUSER) (0) ldap: Performing search in "dc=MYCOMPANY,dc=MYDOMAIN" with filter "(uid=MYUSER)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=MYUSER,ou=people,dc= MYCOMPANY,dc=MYDOMAIN" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
That message should be clear.
Now I have this warning (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute but, with the previous version, I had a similar warning and everything worked fine. WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
(0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
That message should also be clear.
So are you using Active Directory?
No I am not using Active Directory....I don't understand why that message appears....
If so, follow the guide here:
http://deployingradius.com/documents/configuration/active_directory.html
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Thanks Alan. Andrea -- Avvertenze ai sensi del D.Lgs.196 del 30/06/2003 Le informazioni contenute in questo messaggio di posta elettronica e/o files allegati, sono da considerarsi strettamente riservati. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nello stesso. Costituisce violazione ai principi dettati dal D.Lgs. 196/2003: trattenere il messaggio stesso oltre il tempo necessario, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo od utilizzarlo per finalità diverse. In ogni momento potrà richiederci la sospensione dell'impiego dei suoi dati, ad esclusione delle comunicazioni effettuate in esecuzione di obblighi di legge. Qualora avesse ricevuto questo messaggio senza esserne il destinatario La preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso dal Suo sistema. Se desidera presentare un reclamo, può trovare informazioni e supporto sul nostro sito www.widegroup.eu/reclami o può scrivere a reclami@widegroup.eu. Grazie. -- This message is confidential. It may also be privileged or otherwise protected by work, product, immunity or other legal rules. If you have received it by mistake, please let us know by e-mail reply and delete it from your system; you may not copy this message or disclose its contents to anyone. The integrity and security of this message cannot be guaranteed on the Internet. If you want to submit a formal complaint, you can find information and support on our website www.widegroup.eu/reclami or writing to reclami@widegroup.eu. Thank you.
On Sep 1, 2017, at 10:04 AM, Andrea Passuello <andrea.passuello@widegroup.eu> wrote:
Now I have this warning
(0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
but, with the previous version, I had a similar warning and everything worked fine.
Then read your configuration to see where it gets the password from.
No I am not using Active Directory....I don't understand why that message appears....
If your passwords are in LDAP, FreeRADIUS should be able to read them from LDAP. If your passwords aren't in LDAP, you should know where they are located. Alan DeKok.
participants (2)
-
Alan DeKok -
Andrea Passuello