LDAP authentication failed
Hi i have some problems with LDAP authentication. If I login on my windows xp sp3 client i want to check die login credentials against my LDAP service. But the xp client uses doubleslashs in the username!! I think this will be the problem!? If I test with radtest it works. What can i do to succecsful login? Debug log: rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=62, length=240 NAS-IP-Address = 192.168.0.2 NAS-Port = 50009 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C9" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xc5fe953bc3f98c0b9575e677705364e2 EAP-Message = 0x0207006119001703010056b327be51594f6985d1854f17199fefe7151d57481c244787051f7067a50a0056a15e0a831a3aa3661a61aeed66e3c7dc85cd3315301bfd825c786fd60e0110f5124e76e2d543c9a6fd99371be7f1a9637b8ce527669f Message-Authenticator = 0xad6e1b5107c7af4b9a5ba3e648d65859 +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "FIRMA1\usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for FIRMA1\usera [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> FIRMA1\5cusera [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=FIRMA1\5cusera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=FIRMA1\5cusera) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound Configuration part of LDAP module: ldap { server = "192.168.0.5" identity = "cn=admin,dc=firma1,dc=de" password = "xxxx" basedn = "dc=firma1,dc=de" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ...... } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp3217861... Sent from the FreeRadius - User mailing list archive at Nabble.com.
hi, you need to use the ntdomain module and ensure that the \\ method is enabled. (check the realm module section) this will then populate stripped-user-name with just the username and not also have the hostname or domain name lurking around. alan
Hi thx for this hint. I have activated realm ntdomain modul but ldap search dosen't work?? Maybe my used filter is wrong? Debug: +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] No such realm "FIRMA1" ++[ntdomain] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for FIRMA1\usera [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> FIRMA1\5cusera [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=FIRMA1\5cusera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=FIRMA1\5cusera) [ldap] object not found [ldap] search failed realm: # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp3217861... Sent from the FreeRadius - User mailing list archive at Nabble.com.
ok I found my problem. I have forgotten to add my domain in the proxy.conf, after I have done this ldap search works fine. but know I have one more problem with authentification. I want to use peap with mschap to support both windows und linux systems. But authentification fails. I don't know what i have to configure or where is the problem. I would be very happy about some hints. I'm sorry about the very long debug output.... rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=86, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554175bfc9edc831547521be2ad EAP-Message = 0x020300061900 Message-Authenticator = 0xfb650903c72222207e001d0385d8a036 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:40 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 86 to 192.168.0.2 port 1812 EAP-Message = 0x0104003619000f0b409c6f7dd2e83b8a1ad34c1b43c61b5cfa499e7822f081073040ea4c9280acd2686fd194f216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554165cfc9edc831547521be2ad Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=87, length=465 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554165cfc9edc831547521be2ad EAP-Message = 0x020401401980000001361603010106100001020100626313e9c274f169e9ed94821e91d59e61578ab381c0e35788422b88b6e12b77d9551a970514289baaaf9c2ec3edb8ae126c1c5b5f29d7883997fee2eee9f55a635005cb534cf7c708f0a0ec98dbda376e88b67de4616926d9aa586737b2536998fad9c4648c8ce1e3b704415c4031063fc103bf0ddd1159d8b8ef2c5c41332aca99428569333c19f8d539b1a01f232cdf9023030176aef9c9bcea7588447853febc8b340da21d9b5af78d2d8b5b3acc0779e9f8d970f93471273749a0653a7e6611ee11bfcabb019b34e3f54f5e1b693d89fe471eab29d8027641dfed05bfeeeca249fd3561371c EAP-Message = 0xa736d666ebba66d8c0a368d306e0af12f71b43504cad85a614030100010116030100204c903a9993c942b403d46902c7564ea7f66787ca59a02e46fc08946a84aa509d Message-Authenticator = 0x67bf63ab1ed1abebb8161ae463114461 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:40 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 87 to 192.168.0.2 port 1812 EAP-Message = 0x0105003119001403010001011603010020f8490ec428507eb9225fb4fb3682dd9e465b8988e2ad4c39c0e66520252de24e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554115dfc9edc831547521be2ad Finished request 10. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=88, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554115dfc9edc831547521be2ad EAP-Message = 0x020500061900 Message-Authenticator = 0x6c4b11714b857cd0281b682e13c4d900 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:40 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 88 to 192.168.0.2 port 1812 EAP-Message = 0x0106002019001703010015f5a3ae52506203eb77289c53fadddc8aced654bcc9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554105efc9edc831547521be2ad Finished request 11. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=89, length=186 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554105efc9edc831547521be2ad EAP-Message = 0x0206002b19001703010020a6ad92351444936d3c1868fea4cce44c06a598df0d5fa027e4123c6c3daf8f5b Message-Authenticator = 0x66c1321b7a94107cc7e7d22f05c2fbf3 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:41 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 6 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - FIRMA1\usera [peap] Got tunneled request EAP-Message = 0x02060014014649524d41315c626c657273636861 server { PEAP: Got tunneled identity of FIRMA1\usera PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to FIRMA1\usera Sending tunneled request EAP-Message = 0x02060014014649524d41315c626c657273636861 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "FIRMA1\\usera" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 6 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for usera [ldap] expand: %{Stripped-User-Name} -> usera [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=usera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=usera) [ldap] Added User-Password = {SSHA}WNtfzJKztV/VYNqJAew//EpfaqFTTmRY in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x3043423639343838303546373937424632413832383037393733423839353337 [ldap] sambaLmPassword -> LM-Password == 0x3031464335413642453742433639323941414433423433354235313430344545 [ldap] looking for reply items in directory... [ldap] user usera authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010700291a0107002410c823f451f29e4818ccd3f0be9f3650634649524d41315c626c657273636861 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5046181b5037b4806fda72c76d930a8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010700291a0107002410c823f451f29e4818ccd3f0be9f3650634649524d41315c626c657273636861 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5046181b5037b4806fda72c76d930a8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 89 to 192.168.0.2 port 1812 EAP-Message = 0x0107004019001703010035c52325a3ae3a7f6bd4de688fbfef456c0fc3bd0b986af49abfb022fb9ba5a7b92058dc051da50ecf7b3ef7c4eaad3cbd6e99f65e78 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554135ffc9edc831547521be2ad Finished request 12. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=90, length=240 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554135ffc9edc831547521be2ad EAP-Message = 0x0207006119001703010056c97cf317a157bd52798bc228692340b159bf37c206e5a659f93993bfcff9077f69ae0747ad07c868de4fb65a6a1ab6a0212c883f47be656fca32ee3b02a4e6d0c197f4ed72c68d497e8872ad262de7fb1b7737c21234 Message-Authenticator = 0x0aacaddadb8a501835ed2f2cd9df836c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:41 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 7 length 97 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0207004a1a0207004531465311ebc4ad0d394e81e0d169961d1100000000000000001c75cd6fd76bac69737473ecbe0df750a88714f72a4bc71a004649524d41315c626c657273636861 server { PEAP: Setting User-Name to FIRMA1\usera Sending tunneled request EAP-Message = 0x0207004a1a0207004531465311ebc4ad0d394e81e0d169961d1100000000000000001c75cd6fd76bac69737473ecbe0df750a88714f72a4bc71a004649524d41315c626c657273636861 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "FIRMA1\\usera" State = 0xb5046181b5037b4806fda72c76d930a8 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 7 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for usera [ldap] expand: %{Stripped-User-Name} -> usera [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=usera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=usera) [ldap] Added User-Password = {SSHA}WNtfzJKztV/VYNqJAew//EpfaqFTTmRY in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x3043423639343838303546373937424632413832383037393733423839353337 [ldap] sambaLmPassword -> LM-Password == 0x3031464335413642453742433639323941414433423433354235313430344545 [ldap] looking for reply items in directory... [ldap] user usera authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Found LM-Password [mschap] Found NT-Password [mschap] NT Domain delimeter found, should we have enabled with_ntdomain_hack? [mschap] Told to do MS-CHAPv2 for FIRMA1\usera with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [usera/<via Auth-Type = EAP>] (from client TESTSW01 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 90 to 192.168.0.2 port 1812 EAP-Message = 0x010800261900170301001be755b066be3f16eb4a1f8d7d3f54bf6333dc8a1865a7ef9dc1d31c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e5541250fc9edc831547521be2ad Finished request 13. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=91, length=181 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e5541250fc9edc831547521be2ad EAP-Message = 0x020800261900170301001bd0e5d1e8905737296a8cc3e900996439f0cf0a79a1254ecc7514a1 Message-Authenticator = 0xac386bf0ee6044841d403e1ac7a8dea3 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:41 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 8 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [usera/<via Auth-Type = EAP>] (from client TESTSW01 port 50006 cli 00-1A-4B-63-69-0B) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> FIRMA1\usera attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 14 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 14 Sending Access-Reject of id 91 to 192.168.0.2 port 1812 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp3217861... Sent from the FreeRadius - User mailing list archive at Nabble.com.
2 things: 1) near the bottom of the debug output there is a line that's says you are passing the username as domain\user, and it asks if you have enabled the with NT domain hack option? Check your mschap module config to see if this is enabled, it is commented out by default. You can check the complete debug output that includes the server initializing and you can see it there IF it is enabled. 2) I gave up on PEAP/MSCHAPv2 on linux, EAP/TTLS works great for me with no other config tweaks after I got the windows clients working! If there is not a super important requirement to use the same authorization on both platforms you could do the same, just an idea. Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221 -----Original Message----- From: freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.o rg] On Behalf Of snowman5840 Sent: Friday, October 22, 2010 11:58 AM To: freeradius-users@lists.freeradius.org Subject: Re: LDAP authentication failed ok I found my problem. I have forgotten to add my domain in the proxy.conf, after I have done this ldap search works fine. but know I have one more problem with authentification. I want to use peap with mschap to support both windows und linux systems. But authentification fails. I don't know what i have to configure or where is the problem. I would be very happy about some hints. I'm sorry about the very long debug output.... rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=86, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554175bfc9edc831547521be2ad EAP-Message = 0x020300061900 Message-Authenticator = 0xfb650903c72222207e001d0385d8a036 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:40 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 86 to 192.168.0.2 port 1812 EAP-Message = 0x0104003619000f0b409c6f7dd2e83b8a1ad34c1b43c61b5cfa499e7822f081073040ea 4c9280acd2686fd194f216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554165cfc9edc831547521be2ad Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=87, length=465 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554165cfc9edc831547521be2ad EAP-Message = 0x020401401980000001361603010106100001020100626313e9c274f169e9ed94821e91 d59e61578ab381c0e35788422b88b6e12b77d9551a970514289baaaf9c2ec3edb8ae126c 1c5b5f29d7883997fee2eee9f55a635005cb534cf7c708f0a0ec98dbda376e88b67de461 6926d9aa586737b2536998fad9c4648c8ce1e3b704415c4031063fc103bf0ddd1159d8b8 ef2c5c41332aca99428569333c19f8d539b1a01f232cdf9023030176aef9c9bcea758844 7853febc8b340da21d9b5af78d2d8b5b3acc0779e9f8d970f93471273749a0653a7e6611 ee11bfcabb019b34e3f54f5e1b693d89fe471eab29d8027641dfed05bfeeeca249fd3561 371c EAP-Message = 0xa736d666ebba66d8c0a368d306e0af12f71b43504cad85a61403010001011603010020 4c903a9993c942b403d46902c7564ea7f66787ca59a02e46fc08946a84aa509d Message-Authenticator = 0x67bf63ab1ed1abebb8161ae463114461 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:40 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 87 to 192.168.0.2 port 1812 EAP-Message = 0x0105003119001403010001011603010020f8490ec428507eb9225fb4fb3682dd9e465b 8988e2ad4c39c0e66520252de24e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554115dfc9edc831547521be2ad Finished request 10. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=88, length=149 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554115dfc9edc831547521be2ad EAP-Message = 0x020500061900 Message-Authenticator = 0x6c4b11714b857cd0281b682e13c4d900 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:40 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 88 to 192.168.0.2 port 1812 EAP-Message = 0x0106002019001703010015f5a3ae52506203eb77289c53fadddc8aced654bcc9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554105efc9edc831547521be2ad Finished request 11. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=89, length=186 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554105efc9edc831547521be2ad EAP-Message = 0x0206002b19001703010020a6ad92351444936d3c1868fea4cce44c06a598df0d5fa027 e4123c6c3daf8f5b Message-Authenticator = 0x66c1321b7a94107cc7e7d22f05c2fbf3 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:41 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 6 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - FIRMA1\usera [peap] Got tunneled request EAP-Message = 0x02060014014649524d41315c626c657273636861 server { PEAP: Got tunneled identity of FIRMA1\usera PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to FIRMA1\usera Sending tunneled request EAP-Message = 0x02060014014649524d41315c626c657273636861 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "FIRMA1\\usera" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 6 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for usera [ldap] expand: %{Stripped-User-Name} -> usera [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=usera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=usera) [ldap] Added User-Password = {SSHA}WNtfzJKztV/VYNqJAew//EpfaqFTTmRY in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x3043423639343838303546373937424632413832383037393733423839353337 [ldap] sambaLmPassword -> LM-Password == 0x3031464335413642453742433639323941414433423433354235313430344545 [ldap] looking for reply items in directory... [ldap] user usera authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!! +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010700291a0107002410c823f451f29e4818ccd3f0be9f3650634649524d41315c626c 657273636861 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5046181b5037b4806fda72c76d930a8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010700291a0107002410c823f451f29e4818ccd3f0be9f3650634649524d41315c626c 657273636861 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5046181b5037b4806fda72c76d930a8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 89 to 192.168.0.2 port 1812 EAP-Message = 0x0107004019001703010035c52325a3ae3a7f6bd4de688fbfef456c0fc3bd0b986af49a bfb022fb9ba5a7b92058dc051da50ecf7b3ef7c4eaad3cbd6e99f65e78 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e554135ffc9edc831547521be2ad Finished request 12. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=90, length=240 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e554135ffc9edc831547521be2ad EAP-Message = 0x0207006119001703010056c97cf317a157bd52798bc228692340b159bf37c206e5a659 f93993bfcff9077f69ae0747ad07c868de4fb65a6a1ab6a0212c883f47be656fca32ee3b 02a4e6d0c197f4ed72c68d497e8872ad262de7fb1b7737c21234 Message-Authenticator = 0x0aacaddadb8a501835ed2f2cd9df836c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:41 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 7 length 97 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0207004a1a0207004531465311ebc4ad0d394e81e0d169961d1100000000000000001c 75cd6fd76bac69737473ecbe0df750a88714f72a4bc71a004649524d41315c626c657273 636861 server { PEAP: Setting User-Name to FIRMA1\usera Sending tunneled request EAP-Message = 0x0207004a1a0207004531465311ebc4ad0d394e81e0d169961d1100000000000000001c 75cd6fd76bac69737473ecbe0df750a88714f72a4bc71a004649524d41315c626c657273 636861 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "FIRMA1\\usera" State = 0xb5046181b5037b4806fda72c76d930a8 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 7 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for usera [ldap] expand: %{Stripped-User-Name} -> usera [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=usera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=usera) [ldap] Added User-Password = {SSHA}WNtfzJKztV/VYNqJAew//EpfaqFTTmRY in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x3043423639343838303546373937424632413832383037393733423839353337 [ldap] sambaLmPassword -> LM-Password == 0x3031464335413642453742433639323941414433423433354235313430344545 [ldap] looking for reply items in directory... [ldap] user usera authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!! +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Found LM-Password [mschap] Found NT-Password [mschap] NT Domain delimeter found, should we have enabled with_ntdomain_hack? [mschap] Told to do MS-CHAPv2 for FIRMA1\usera with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [usera/<via Auth-Type = EAP>] (from client TESTSW01 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 90 to 192.168.0.2 port 1812 EAP-Message = 0x010800261900170301001be755b066be3f16eb4a1f8d7d3f54bf6333dc8a1865a7ef9d c1d31c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1558e5541250fc9edc831547521be2ad Finished request 13. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=91, length=181 NAS-IP-Address = 192.168.0.2 NAS-Port = 50006 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C6" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0x1558e5541250fc9edc831547521be2ad EAP-Message = 0x020800261900170301001bd0e5d1e8905737296a8cc3e900996439f0cf0a79a1254ecc 7514a1 Message-Authenticator = 0xac386bf0ee6044841d403e1ac7a8dea3 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.2/auth-detail-20101022 [auth_log] expand: %t -> Fri Oct 22 18:32:41 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] Looking up realm "FIRMA1" for User-Name = "FIRMA1\usera" [ntdomain] Found realm "FIRMA1" [ntdomain] Adding Stripped-User-Name = "usera" [ntdomain] Adding Realm = "FIRMA1" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 8 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [usera/<via Auth-Type = EAP>] (from client TESTSW01 port 50006 cli 00-1A-4B-63-69-0B) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> FIRMA1\usera attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 14 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 14 Sending Access-Reject of id 91 to 192.168.0.2 port 1812 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp321 7861p3232594.html Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
wow. hey now it's working with both OS ;-) . thx for your hint, nt_hack was missing. -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp3217861... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (3)
-
Alan Buxey -
Sallee, Stephen (Jake) -
snowman5840