Hello! I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) In radcheck table I added: testuser Max-Daily-Session := 600 I enabled dailycounter in counters.conf: sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(`Acct-Session-Time` - \ GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)), 0)) \ FROM accounting WHERE `User-Name` = '%{${key}}' AND \ UNIX_TIMESTAMP(`Acct-Start-Time`) + `Acct-Session-Time` > '%b'" } In sites-available/default I have the following: authorize { if (User-Password) { update control { Auth-Type := ldap Ldap-UserDN := "eduPersonPrincipalName=%{User-Name},dc=example,dc=com" } } sql dailycounter } authenticate { Auth-Type LDAP { ldap } } Debug output: rad_recv: Access-Request packet from host 10.10.10.10 port 33651, id=75, length=202 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:24:D7:47:1C:XX" Called-Station-Id = "hs-kit-testing" NAS-Port-Id = "bridge-bralci" User-Name = "testuser" NAS-Port = 2151677975 Acct-Session-Id = "80400017" Framed-IP-Address = 192.168.81.198 Mikrotik-Host-IP = 192.168.81.198 User-Password = "password" Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.81.1" NAS-Identifier = "kit-testing" NAS-IP-Address = 192.168.1.116 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (User-Password) ? Evaluating (User-Password) -> TRUE ++? if (User-Password) -> TRUE ++- entering if (User-Password) {...} expand: eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi -> eduPersonPrincipalName=testuser,dc=example,dc=com +++[control] returns notfound ++- if (User-Password) returns notfound [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound *rlm_sqlcounter: Entering module authorize code** **rlm_sqlcounter: Could not find Check item value pair** **++[dailycounter] returns noop* Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "testuser" with password "password" [ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com [ldap] (re)connect to ldaps.example.com:636, authentication 1 [ldap] setting TLS mode to 1 [ldap] bind as eduPersonPrincipalName=testuser,dc=example,dc=com/password to ldaps.example.com:636 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user testuser authenticated succesfully ++[ldap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 75 to 10.10.10.10 port 33651 Why doesn't radius find Check item value pair? It does exists in radcheck table... Does it only work for local mysql users? Matej -- --- Matej Zerovnik
Matej Žerovnik wrote:
Hello!
I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) ... rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound
The "testuser" isn't found. So the sqlcounter module can't do it's job, because it doesn't know what value to use for the session limit. Alan DeKok.
On 20.10.2014 23:40, Alan DeKok wrote:
Matej Žerovnik wrote:
Hello!
I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) ... rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound The "testuser" isn't found. So the sqlcounter module can't do it's job, because it doesn't know what value to use for the session limit. This is the part that is giving me troubles... My users exists in LDAP to which I don't have access, but I can authenticate with UserDN. I added entry testuser Max-Daily-Session := 600 to mysql radcheck table hoping radius will pick it up and use it in 'dailycounter'.
Is that even suppose to work? Can I use 'dailycounter' on LDAP authenticated users or does that only work on local users, who are in sql database? Matej
Matej Žerovnik wrote:
This is the part that is giving me troubles... My users exists in LDAP to which I don't have access, but I can authenticate with UserDN.
The debug log shows that the user isn't found in LDAP. Go fix that.
I added entry testuser Max-Daily-Session := 600 to mysql radcheck table hoping radius will pick it up and use it in 'dailycounter'.
OK.
Is that even suppose to work?
Of course. The "counter" module doesn't care where you get the Max-Daily-Session attribute from.
Can I use 'dailycounter' on LDAP authenticated users or does that only work on local users, who are in sql database?
It works anywhere. I suspect you're not reading the debug output. That is almost always the problem when issues like this can't be solved. What's probably happening is that you're doing the "dailycounter" checks BEFORE the "sql" module. So the Max-Daily-Session attribute is added too late. Again, READ THE DEBUG OUTPUT. It will tell you what's going on. Alan DeKok.
On 28.10.2014 21:26, Matej Žerovnik wrote:
On 20.10.2014 23:40, Alan DeKok wrote:
Matej Žerovnik wrote:
Hello!
I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) ... rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound The "testuser" isn't found. So the sqlcounter module can't do it's job, because it doesn't know what value to use for the session limit.
I posted this a while ago, but I'm trying my luck one more time if anyone can point me to the right direction: This is the part that is giving me troubles... My users exists in LDAP to which I don't have access, but I can authenticate with UserDN. I added entry testuser Max-Daily-Session := 600 to mysql radcheck table hoping radius will pick it up and use it in 'dailycounter'. Access-request packet looks like this: rad_recv: Access-Request packet from host 10.10.10.10 port 33651, id=75, length=202 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:24:D7:47:1C:XX" Called-Station-Id = "hs-kit-testing" NAS-Port-Id = "bridge-bralci" User-Name = "testuser" NAS-Port = 2151677975 Acct-Session-Id = "80400017" Framed-IP-Address = 192.168.81.198 Mikrotik-Host-IP = 192.168.81.198 User-Password = "password" Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.81.1" NAS-Identifier = "kit-testing" NAS-IP-Address = 192.168.1.116 Can RADIUS use the username provided in access-request for the sqldailycounter? Is that even suppose to work? Can I use 'dailycounter' on LDAP authenticated users or does that only work on local users, who are in sql database? Matej -- --- Matej Zerovnik
Matej Žerovnik wrote:
This is the part that is giving me troubles... My users exists in LDAP to which I don't have access, but I can authenticate with UserDN. I added entry testuser Max-Daily-Session := 600 to mysql radcheck table hoping radius will pick it up and use it in 'dailycounter'.
That should be picked up. Read the debug log to see what's happening.
Access-request packet looks like this:
I don't care. The *rest* of the debug log matters.
Can RADIUS use the username provided in access-request for the sqldailycounter?
Of course.
Is that even suppose to work?
Yes.
Can I use 'dailycounter' on LDAP authenticated users or does that only work on local users, who are in sql database?
See my other messages on this list. The server cares only about attributes. It doesn't care where they come from. If the server isn't reading Max-Daily-Session from SQL, it's because you configured the server wrong. Alan DeKok.
On 2.11.2014 14:36, Alan DeKok wrote:
Matej Žerovnik wrote:
This is the part that is giving me troubles... My users exists in LDAP to which I don't have access, but I can authenticate with UserDN. I added entry testuser Max-Daily-Session := 600 to mysql radcheck table hoping radius will pick it up and use it in 'dailycounter'. That should be picked up. Read the debug log to see what's happening. I moved to radius 3.0.2 as part of moving to CentOS 7 and now it's working...
Matej
participants (2)
-
Alan DeKok -
Matej Žerovnik