Auth-Type in authorize users' file
Hello, I'm updating my freeradius server from 2.2.x to 3.0.6. In one of my virtual servers I use a ldap backend. In my current 2.2.x, the configuration I have is: server myvirtualserver { authorize { preprocess suffix files_myvirtualserver } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { myldap } } ... } where <myldap> is in modules/ldap-myldap: ldap myldap { server = ... ... } and the users' file defined in files_myvirtualserver is: <mylogin> Realm = mydomain.com, Auth-Type = LDAP User-Name := `%{Stripped-User-Name}`, Fall-Through = No ... DEFAULT Auth-Type := Reject This configuration is working with my current 2.2.0 server. But when I try to create the same configuration in a new 3.0.6 server I have the error: reading pairlist file /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-config/files_myvirtualserver/authorize[3]: Parse error (check) for entry <mylogin>: Unknown or invalid value "LDAP" for attribute "Auth-Type" Failed reading /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-enabled/files_myvirtualserver[8]: Instantiation failed for module "files_adminslogin" Any help? Thanks in advance. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337 I
On Feb 24, 2015, at 7:10 AM, Angel L. Mateo <amateo@um.es> wrote:
I'm updating my freeradius server from 2.2.x to 3.0.6.
3.0.7 was just released.
This configuration is working with my current 2.2.0 server. But when I try to create the same configuration in a new 3.0.6 server I have the error:
reading pairlist file /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-config/files_myvirtualserver/authorize[3]: Parse error (check) for entry <mylogin>: Unknown or invalid value "LDAP" for attribute "Auth-Type" Failed reading /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-enabled/files_myvirtualserver[8]: Instantiation failed for module "files_adminslogin"
Any help? Thanks in advance.
From the 3.0.7 ChangeLog: * Be more careful to define Auth-Types before loading modules. Alan DeKok.
El 24/02/15 a las 14:08, Alan DeKok escribió:
On Feb 24, 2015, at 7:10 AM, Angel L. Mateo <amateo@um.es> wrote:
I'm updating my freeradius server from 2.2.x to 3.0.6.
3.0.7 was just released.
This configuration is working with my current 2.2.0 server. But when I try to create the same configuration in a new 3.0.6 server I have the error:
reading pairlist file /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-config/files_myvirtualserver/authorize[3]: Parse error (check) for entry <mylogin>: Unknown or invalid value "LDAP" for attribute "Auth-Type" Failed reading /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-enabled/files_myvirtualserver[8]: Instantiation failed for module "files_adminslogin"
Any help? Thanks in advance.
From the 3.0.7 ChangeLog:
* Be more careful to define Auth-Types before loading modules.
And any help about what "be more careful" means? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
It means the bug is fixed?
On Feb 24, 2015, at 8:49 AM, Angel L. Mateo <amateo@um.es> wrote:
El 24/02/15 a las 14:08, Alan DeKok escribió:
On Feb 24, 2015, at 7:10 AM, Angel L. Mateo <amateo@um.es> wrote: I'm updating my freeradius server from 2.2.x to 3.0.6.
3.0.7 was just released.
This configuration is working with my current 2.2.0 server. But when I try to create the same configuration in a new 3.0.6 server I have the error:
reading pairlist file /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-config/files_myvirtualserver/authorize[3]: Parse error (check) for entry <mylogin>: Unknown or invalid value "LDAP" for attribute "Auth-Type" Failed reading /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-enabled/files_myvirtualserver[8]: Instantiation failed for module "files_adminslogin"
Any help? Thanks in advance.
From the 3.0.7 ChangeLog:
* Be more careful to define Auth-Types before loading modules. And any help about what "be more careful" means?
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
El 24/02/15 a las 15:28, Alan DeKok escribió:
It means the bug is fixed?
Ah... Ok. I interpreted as I was doing something wrong. Sorry. Meanwhile, I've been looking for information. According to http://deployingradius.com/documents/configuration/auth_type.html (Common misuses section), Auth-Type main use is to force the user to be accepted or rejected, but Auth-Type should not be used. In the doc modules/ldap_howto.rst.gz doesn't use this too. According to this, I'm trying to remove the Auth-Type = LDAP on the users' file. But now the user is rejected and freeradius debug shows: (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject So, what is the correct way to configure? At this moment, the config I'm trying is: authorize { preprocess suffix files ldap } authenticate { ldap } and my user' authorization file is: <login> Fall-Through = No
On Feb 24, 2015, at 8:49 AM, Angel L. Mateo <amateo@um.es> wrote:
El 24/02/15 a las 14:08, Alan DeKok escribió:
On Feb 24, 2015, at 7:10 AM, Angel L. Mateo <amateo@um.es> wrote: I'm updating my freeradius server from 2.2.x to 3.0.6.
3.0.7 was just released.
This configuration is working with my current 2.2.0 server. But when I try to create the same configuration in a new 3.0.6 server I have the error:
reading pairlist file /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-config/files_myvirtualserver/authorize[3]: Parse error (check) for entry <mylogin>: Unknown or invalid value "LDAP" for attribute "Auth-Type" Failed reading /etc/freeradius/mods-config/files_myvirtualserver/authorize /etc/freeradius/mods-enabled/files_myvirtualserver[8]: Instantiation failed for module "files_adminslogin"
Any help? Thanks in advance.
From the 3.0.7 ChangeLog:
* Be more careful to define Auth-Types before loading modules. And any help about what "be more careful" means?
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
Version 3? The LDAP module/code has had a lot of changes and the latest documentation is in the module/server config files. The server basically needs to be given a hint to use ldap as the authn/authz source alan
On Feb 25, 2015, at 3:13 AM, Angel L. Mateo <amateo@um.es> wrote:
Meanwhile, I've been looking for information. According to http://deployingradius.com/documents/configuration/auth_type.html (Common misuses section), Auth-Type main use is to force the user to be accepted or rejected, but Auth-Type should not be used. In the doc modules/ldap_howto.rst.gz doesn't use this too.
It *recommends* to not force Auth-Type. Because forcing it is almost always wrong.
According to this, I'm trying to remove the Auth-Type = LDAP on the users' file. But now the user is rejected and freeradius debug shows:
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
So, what is the correct way to configure?
For you, set Auth-Type to LDAP. If it works… do it. Otherwise, don’t. The recommendation comes because some people are dead set on using it. Then, they complain that “it doesn’t work”. Sometimes it’s easier to just say “don’t do that”, instead of giving explanations those people don’t read. Alan DeKok.
El 25/02/15 a las 15:42, Alan DeKok escribió:
On Feb 25, 2015, at 3:13 AM, Angel L. Mateo <amateo@um.es> wrote:
Meanwhile, I've been looking for information. According to http://deployingradius.com/documents/configuration/auth_type.html (Common misuses section), Auth-Type main use is to force the user to be accepted or rejected, but Auth-Type should not be used. In the doc modules/ldap_howto.rst.gz doesn't use this too.
It *recommends* to not force Auth-Type. Because forcing it is almost always wrong.
According to this, I'm trying to remove the Auth-Type = LDAP on the users' file. But now the user is rejected and freeradius debug shows:
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
So, what is the correct way to configure?
For you, set Auth-Type to LDAP.
If it works… do it. Otherwise, don’t. The recommendation comes because some people are dead set on using it. Then, they complain that “it doesn’t work”. Sometimes it’s easier to just say “don’t do that”, instead of giving explanations those people don’t read.
Ok. Thank you very much. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
participants (3)
-
Alan Buxey -
Alan DeKok -
Angel L. Mateo