ldap group membership check issue
Hello. I'm trying to check a group of user in Active directory (Win2008) using rlm_ldap. While we have several domains in transitive relations, I should send username with domain part. When domain name is a suffix ( epodberezkin@chtpz.ru), it is working, prefix - not (when windows uses login username and domain automatically - f.e. CHTPZ0\epodberezkin) part of mods-enabled/ldap user { base_dn = "dc=chtpz,dc=ru" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } Output of radiusd -X shows, that "DOMAIN\" part is not removed, so sAMAccountname is incorrect Fri Oct 27 14:48:39 2017 : Debug: (7) files: Searching for user in group "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Reserved connection (0) Fri Oct 27 14:48:39 2017 : Debug: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) Fri Oct 27 14:48:39 2017 : Debug: Parsed xlat tree: Fri Oct 27 14:48:39 2017 : Debug: literal --> (sAMAccountName= Fri Oct 27 14:48:39 2017 : Debug: XLAT-IF { Fri Oct 27 14:48:39 2017 : Debug: attribute --> Stripped-User-Name Fri Oct 27 14:48:39 2017 : Debug: } Fri Oct 27 14:48:39 2017 : Debug: XLAT-ELSE { Fri Oct 27 14:48:39 2017 : Debug: attribute --> User-Name Fri Oct 27 14:48:39 2017 : Debug: } Fri Oct 27 14:48:39 2017 : Debug: literal --> ) Fri Oct 27 14:48:39 2017 : Debug: (7) files: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) Fri Oct 27 14:48:39 2017 : Debug: (7) files: --> ( *sAMAccountName=CHTPZ0\5c5cepodberezkin*) Fri Oct 27 14:48:39 2017 : Debug: (7) files: Performing search in "dc=chtpz,dc=ru" with filter "(sAMAccountName=CHTPZ0\5c5cepodberezkin)", scope "sub" Fri Oct 27 14:48:39 2017 : Debug: (7) files: Waiting for search result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://DomainDnsZones.chtpz.ru/DC=DomainDnsZones,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://ForestDnsZones.chtpz.ru/DC=ForestDnsZones,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://chtpz.ru/CN=Configuration,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: (7) files: Search returned no results How can I fix this??
On Oct 27, 2017, at 6:03 AM, Евгений Подберезкин <epodber@gmail.com> wrote:
I'm trying to check a group of user in Active directory (Win2008) using rlm_ldap. While we have several domains in transitive relations, I should send username with domain part. When domain name is a suffix ( epodberezkin@chtpz.ru), it is working, prefix - not (when windows uses login username and domain automatically - f.e. CHTPZ0\epodberezkin)
You need to configure the ntdomain module. See raddb/sites-enabled/default, and look for "ntdomain". And see raddb/mods-available/realm. Also look for "ntdomain"
Output of radiusd -X shows, that "DOMAIN\" part is not removed, so sAMAccountname is incorrect
That's "radiusd -Xxx". PLEASE follow instructions and just use "radiusd -X". Honestly, I now have to say this DAILY on the list. What's going on, people? On top of that, it's only a tiny portion of the debug output.
How can I fix this??
Configure CHTPZ0 as a realm. And do ntdomain checking. Again, if you follow instructions, run "radiusd -X", and *read the output", you would see it finding the "chtpz.ru" realm, and stripping it. That should be a strong hint that you probably also need to configure a CHTPZ0 domain, too. Alan DeKok.
Hi, Alan. Thanks for the reply. I 've already added the realms to proxy.conf , but adding ntdomain module wasn`t obvious for me (suffix is enabled by default, so I did not care of it). I have one more question, could you give me hint. If check LDAP-Group in etc/raddb/users, it works. DEFAULT chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" DEFAULT Auth-Type := Reject Reply-Message = "Group do not match" But if I need to set an attribute in post-auth, it does not F.e. in sites-enabled/default or sites-enabled/inner-tunnel post-auth { if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { Tunnel-Private-Group-ID := "165" } radiusd -X : (9) # Executing section post-auth from file /opt/freeradius3/etc/raddb/sites-enabled/default (9) post-auth { (9) if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { (9) *if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") -> FALSE* (9) update { (9) No attributes updated (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop 2017-10-27 15:58 GMT+05:00 Alan DeKok <aland@deployingradius.com>:
On Oct 27, 2017, at 6:03 AM, Евгений Подберезкин <epodber@gmail.com> wrote:
I'm trying to check a group of user in Active directory (Win2008) using rlm_ldap. While we have several domains in transitive relations, I should send username with domain part. When domain name is a suffix ( epodberezkin@chtpz.ru), it is working, prefix - not (when windows uses login username and domain automatically - f.e. CHTPZ0\epodberezkin)
You need to configure the ntdomain module. See raddb/sites-enabled/default, and look for "ntdomain". And see raddb/mods-available/realm. Also look for "ntdomain"
Output of radiusd -X shows, that "DOMAIN\" part is not removed, so sAMAccountname is incorrect
That's "radiusd -Xxx". PLEASE follow instructions and just use "radiusd -X". Honestly, I now have to say this DAILY on the list. What's going on, people?
On top of that, it's only a tiny portion of the debug output.
How can I fix this??
Configure CHTPZ0 as a realm. And do ntdomain checking.
Again, if you follow instructions, run "radiusd -X", and *read the output", you would see it finding the "chtpz.ru" realm, and stripping it. That should be a strong hint that you probably also need to configure a CHTPZ0 domain, too.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Hi In the file users, I guess you can just do DEFAULT chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" Tunnel-Private-Group-ID := "165" DEFAULT Auth-Type := Reject Reply-Message = "Group do not match" It will return the vlan only if the authentication stage is correct. Regards, -- Jérôme BERTHIER
On Oct 27, 2017, at 7:49 AM, Евгений Подберезкин <epodber@gmail.com> wrote:
Thanks for the reply. I 've already added the realms to proxy.conf , but adding ntdomain module wasn`t obvious for me (suffix is enabled by default, so I did not care of it).
Yes, that's not obvious.
I have one more question, could you give me hint.
If check LDAP-Group in etc/raddb/users, it works.
DEFAULT chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru"
DEFAULT Auth-Type := Reject Reply-Message = "Group do not match"
But if I need to set an attribute in post-auth, it does not
F.e. in sites-enabled/default or sites-enabled/inner-tunnel
That sets the attribute in the *inner-tunnel*. You still need to get it to the outer, default server. See raddb/mods-available/eap. Look for "use_tunneled_reply".
post-auth {
if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { Tunnel-Private-Group-ID := "165" }
radiusd -X :
(9) # Executing section post-auth from file /opt/freeradius3/etc/raddb/sites-enabled/default (9) post-auth { (9) if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { (9) *if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") -> FALSE*
Which means it doesn't match. Find out why, first. See the comments at the top of the "inner-tunnel" virtual server for how to debug it. Alan DeKok.
Thank you for your help. "use_tunneled_reply" solved my problem. 2017-10-27 17:48 GMT+05:00 Alan DeKok <aland@deployingradius.com>:
On Oct 27, 2017, at 7:49 AM, Евгений Подберезкин <epodber@gmail.com> wrote:
Thanks for the reply. I 've already added the realms to proxy.conf , but adding ntdomain module wasn`t obvious for me (suffix is enabled by
default,
so I did not care of it).
Yes, that's not obvious.
I have one more question, could you give me hint.
If check LDAP-Group in etc/raddb/users, it works.
DEFAULT chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru"
DEFAULT Auth-Type := Reject Reply-Message = "Group do not match"
But if I need to set an attribute in post-auth, it does not
F.e. in sites-enabled/default or sites-enabled/inner-tunnel
That sets the attribute in the *inner-tunnel*. You still need to get it to the outer, default server.
See raddb/mods-available/eap. Look for "use_tunneled_reply".
post-auth {
if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { Tunnel-Private-Group-ID := "165" }
radiusd -X :
(9) # Executing section post-auth from file /opt/freeradius3/etc/raddb/sites-enabled/default (9) post-auth { (9) if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { (9) *if (chtpzldap-LDAP-Group == "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") -> FALSE*
Which means it doesn't match. Find out why, first.
See the comments at the top of the "inner-tunnel" virtual server for how to debug it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (3)
-
Alan DeKok -
Jérôme BERTHIER -
Евгений Подберезкин