Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action"
Hi, I'm well aware about not setting Auth-Type and let freeradius choose properly auth method, but I need LDAP authentication, and IT staff of LDAP server is very hostile to give freeradius userPassword info. So, my only choice is binding user to LDAP, and pray for the best... AFAIK, if I can't get proper userPassword (stored in SHA1 in LDAP), I'll never reach PAP module, and my only way out is using LDAP binding in authorize and authenticate sections of inner-tunnel. I'm using 2.1.12 version, and my inner-tunnel is as follows: server inner-tunnel { authorize { suffix eap { ok = return } switch "%{Realm}" { case "alumno.upo.es" { LDAP_estudiantes } case "upo.es" { LDAP_docentes } } } authenticate { eap Auth-Type LDAP_estudiantes { LDAP_estudiantes } Auth-Type LDAP_docentes { LDAP_docentes } Auth-Type PAP { pap } } session { radutmp } post-auth { reply_log Post-Auth-Type REJECT { attr_filter.access_reject } update outer.reply { User-Name = "%{request:User-Name}" } } And modules/ldap is as follows: ldap LDAP_estudiantes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:estudiantes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } ldap LDAP_docentes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:Docentes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } And, if I try one user with "alumno.XX.XX" realm, I'm getting: [ttls] Got tunneled request User-Name = "uwifialumno@alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXX" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "uwifialumno@alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXXX" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [suffix] Looking up realm "alumno.XXX.XX" for User-Name = "uwifialumno@alumno.XXX.XX<mailto:uwifialumno@alumno.XXX.XX>" [suffix] Found realm "alumno.XXX.XX" [suffix] Adding Stripped-User-Name = "uwifialumno" [suffix] Adding Realm = "alumno.XXX.XX" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Realm} -> alumno.XXX.XX ++- entering switch %{Realm} {...} +++- entering case alumno.XXX.XX {...} [LDAP_estudiantes] performing user authorization for uwifialumno [LDAP_estudiantes] expand: (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XXX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XXX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> -> (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] expand: o=XXXXXX, c=XX -> o=XXXXX, c=XX [LDAP_estudiantes] ldap_get_conn: Checking Id: 0 [LDAP_estudiantes] ldap_get_conn: Got Id: 0 [LDAP_estudiantes] performing search in o=XXXXX, c=XX, with filter (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] looking for check items in directory... [LDAP_estudiantes] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [LDAP_estudiantes] Setting Auth-Type = LDAP_estudiantes [LDAP_estudiantes] user uwifialumno authorized to use remote access [LDAP_estudiantes] ldap_release_conn: Release Id: 0 ++++[LDAP_estudiantes] returns ok +++- case alumno.upo.es returns ok ++- switch %{Realm} returns ok Found Auth-Type = LDAP_estudiantes WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Login incorrect: [uwifialumno] (from client RedAPs-oviwan port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Why am I getting "Unknown value specified for Auth-Type", if I define: Auth-Type LDAP_estudiantes { LDAP_estudiantes } In my inner-tunnel config file? Thanks in advance, Ignacio Siles Jefe de Proyecto- Infraestructuras / Sol. y Prod. Wireless Dirección de Servicios y Soluciones I.T. Teléfono: +34 672.283.836 Skype jisiles.ingenia C/Severo Ochoa, 43 Parque Tecnológico de Andalucía 29590. Málaga Tel: +34 952029300 | Fax: +34 952029309 www.ingenia.es<http://www.ingenia.es>
On Jun 25, 2015, at 11:50 AM, José Ignacio Siles Rueda <jisiles@ingenia.es> wrote:
Why am I getting "Unknown value specified for Auth-Type", if I define:
Auth-Type LDAP_estudiantes { LDAP_estudiantes }
In my inner-tunnel config file?
Because you're running 2.1.12. Upgrade to 2.2.8, and the problem will disappear. Or, edit raddb/dictionary, and add VALUE Auth-Type LDAP_estudiantes 16 Alan DeKok.
Thank you, I've tried what you mentioned, in /etc/raddb/dictionary, and I'm still getting same error message. I'll upgrade to 2.2.8 as you recommend. Thanks. -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+jisiles=ingenia.es@lists.freeradius.org] En nombre de Alan DeKok Enviado el: viernes, 26 de junio de 2015 3:44 Para: FreeRadius users mailing list Asunto: Re: Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action" On Jun 25, 2015, at 11:50 AM, José Ignacio Siles Rueda <jisiles@ingenia.es> wrote:
Why am I getting "Unknown value specified for Auth-Type", if I define:
Auth-Type LDAP_estudiantes { LDAP_estudiantes }
In my inner-tunnel config file?
Because you're running 2.1.12. Upgrade to 2.2.8, and the problem will disappear. Or, edit raddb/dictionary, and add VALUE Auth-Type LDAP_estudiantes 16 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, I've tried those two recommendations, with no luck. I'm now in 2.2.8: [XXXX@radius3 etc]# radiusd -X radiusd: FreeRADIUS Version 2.2.8, for host x86_64-unknown-linux-gnu, built on Jul 22 2015 at 12:24:46 And LDAP module seems to be OK: Module: Instantiating module "LDAP_estudiantes" from file /usr/local/etc/raddb/modules/LDAP_estudiantes ldap LDAP_estudiantes { server = "XXXXX" port = 389 password = "" .... } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute LDAP_estudiantes-Ldap-Group rlm_ldap: Registering ldap_groupcmp for LDAP_estudiantes-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name LDAP_estudiantes rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header conns: 0x1dee480 When testing, realm is detected OK, and LDAP_estudiantes is called, as specified in inner-tunnel config: authenticate { eap #Auth-Type LDAP_gestores { # LDAP_gestores #} Auth-Type LDAP_estudiantes { LDAP_estudiantes } Auth-Type LDAP_docentes { LDAP_docentes } Auth-Type PAP { pap } } But I'm still getting ++switch %{Realm} { expand: %{Realm} -> alumno.upo.es ++switch %{Realm} { +++case alumno.upo.es { [LDAP_estudiantes] performing user authorization for uwifialumno ...... [LDAP_estudiantes] Setting Auth-Type = LDAP_estudiantes ...... ++++[LDAP_estudiantes] = ok +++} # case alumno.upo.es = ok ++} # switch %{Realm} = ok +} # group authorize = ok Found Auth-Type = LDAP_estudiantes WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. My primary goal is to use the realm in order to get to specific LDAP instantiation, maybe I'm using wrong approach. Regards, Ignacio Siles. -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+jisiles=ingenia.es@lists.freeradius.org] En nombre de Alan DeKok Enviado el: viernes, 26 de junio de 2015 3:44 Para: FreeRadius users mailing list Asunto: Re: Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action" On Jun 25, 2015, at 11:50 AM, José Ignacio Siles Rueda <jisiles@ingenia.es> wrote:
Why am I getting "Unknown value specified for Auth-Type", if I define:
Auth-Type LDAP_estudiantes { LDAP_estudiantes }
In my inner-tunnel config file?
Because you're running 2.1.12. Upgrade to 2.2.8, and the problem will disappear. Or, edit raddb/dictionary, and add VALUE Auth-Type LDAP_estudiantes 16 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 5, 2015, at 11:36 AM, José Ignacio Siles Rueda <jisiles@ingenia.es> wrote:
I've tried those two recommendations, with no luck.
If you update the dictionaries, it will work. The only reason it won't work is if you're editing a different dictionary file than the server is reading, OR if you have typos in the names. In v3, the automatic creation of values for Auth-Type works better. Alan DeKok.
Hello, My actions so far: - I've updated /usr/local/etc/raddb/dictionary as requested, checking also for typos: " ... #ATTRIBUTE My-Local-String 3000 string #ATTRIBUTE My-Local-IPAddr 3001 ipaddr #ATTRIBUTE My-Local-Integer 3002 integer VALUE Auth-Type LDAP_estudiantes 16 " - I've checked dictionary loading in debug mode: ..... including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/LDAP_estudiantes .... main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" .... - I've checked module instantiation with no errors: .... rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute LDAP_estudiantes-Ldap-Group rlm_ldap: Registering ldap_groupcmp for LDAP_estudiantes-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name LDAP_estudiantes .... Module: Instantiating module "LDAP_estudiantes" from file /usr/local/etc/raddb/modules/LDAP_estudiantes ldap LDAP_estudiantes { server = "ldap.upo.es" port = 389 password = "" - I've upgraded to 2.2.8 But I'm still getting same error: ++++[LDAP_estudiantes] = ok +++} # case alumno.upo.es = ok ++} # switch %{Realm} = ok +} # group authorize = ok Found Auth-Type = LDAP_estudiantes WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Using Post-Auth-Type Reject Is migrating to v3 my only remaining option? Should I check anything else? Regards, Ignacio Siles. -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+jisiles=ingenia.es@lists.freeradius.org] En nombre de Alan DeKok Enviado el: miércoles, 5 de agosto de 2015 18:21 Para: FreeRadius users mailing list Asunto: Re: Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action" On Aug 5, 2015, at 11:36 AM, José Ignacio Siles Rueda <jisiles@ingenia.es> wrote:
I've tried those two recommendations, with no luck.
If you update the dictionaries, it will work. The only reason it won't work is if you're editing a different dictionary file than the server is reading, OR if you have typos in the names. In v3, the automatic creation of values for Auth-Type works better. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
José Ignacio Siles Rueda