Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
Hi, All, I am user and want to integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication. Our operating system is Fedora 5 Linux. (1)Install freeRadius-1.1.6 After following the instruction of installation in http://wwww.freeradius.org, install freeRadius-1.1.6 on Fedora Linux 5, run radius server in debug mode radiusd -X ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. FreeRadius was installed succeefully. (2)Configure freeRadius-1.1.6 (2.1) Configure radiusd.conf (2.1.1) LDAP module ldap{ server = "10.0.0.118" identity = "cn=Manager,dc=mtcable,dc=net" password = mtncnl1970 basedn = "dc=mtcable,dc=net" filter = "uid=%{Stripped-User-Name:-%{User-Name}}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } (2.1.2) authorize module uncomment ldap line authorize{ ...... ldap ...... } (2.1.3) authenticate module uncomment block ldap block: authenticate{ ...... Auth-Type LDAP { ldap } ...... } (2.2) edit /usr/local/etc/raddb/users Uncomment the following lines: DEFAULT Auth-Type = LDAP Fall-Through = 1 (3)Install openLDAP (4)Configure openLDAP (5)Add one LDAP entry for testing dn: uid=jjeep, ou=radius, rccd=AAA3140018f, dc=mtcable,dc=net userPassword:: aabbccdd cn: jeep uid: jjeep radiusAuthType: local radiusSimultaneousUse: 1 homeDirectory: // objectClass: top objectClass: posixAccount objectClass: radiusprofile uidNumber: 7012 gidNumber: 100 After add this entry to LDAP, we reset the password to "888888" (5)Test After run test command line radtest jjeep "888888" localhost 1 testing123 The following is information from running Radiusd -X: ...... rad_recv: Access-Request packet from host 127.0.0.1:32771, id=192, length=57 User-Name = "jjeep" User-Password = "888888" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jjeep", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jjeep radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.0.0.118:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 970 to 10.0.0.118:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for req uest 0 rlm_pap: WARNING! No "known good" password found for the use r. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "jjeep" with password "888888" radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [jjeep] (from cl ient localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request The following is logfile: ...... May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" method=128 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 RESULT tag=97 err=0 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH attr=uid May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text= It looks like LDAP search successfully and found 3 entries, but redius server could not find any objects. What is wrong with my integration? Thanks In Advanced Robin ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091
Freeradius expects exactly one answer: rlm_ldap: object not found or got ambiguous search result kind regards Pshem On 22/05/07, xuebin gong <robin_gong@yahoo.com> wrote:
Hi, All,
I am user and want to integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication. Our operating system is Fedora 5 Linux.
(1)Install freeRadius-1.1.6 After following the instruction of installation in http://wwww.freeradius.org, install freeRadius-1.1.6 on Fedora Linux 5, run radius server in debug mode
radiusd -X ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.
FreeRadius was installed succeefully.
(2)Configure freeRadius-1.1.6 (2.1) Configure radiusd.conf (2.1.1) LDAP module ldap{ server = "10.0.0.118" identity = "cn=Manager,dc=mtcable,dc=net" password = mtncnl1970 basedn = "dc=mtcable,dc=net" filter = "uid=%{Stripped-User-Name:-%{User-Name}}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } (2.1.2) authorize module uncomment ldap line
authorize{ ...... ldap ...... }
(2.1.3) authenticate module uncomment block ldap block:
authenticate{ ...... Auth-Type LDAP { ldap } ...... }
(2.2) edit /usr/local/etc/raddb/users Uncomment the following lines:
DEFAULT Auth-Type = LDAP Fall-Through = 1
(3)Install openLDAP (4)Configure openLDAP (5)Add one LDAP entry for testing
dn: uid=jjeep, ou=radius, rccd=AAA3140018f, dc=mtcable,dc=net userPassword:: aabbccdd cn: jeep uid: jjeep radiusAuthType: local radiusSimultaneousUse: 1 homeDirectory: // objectClass: top objectClass: posixAccount objectClass: radiusprofile uidNumber: 7012 gidNumber: 100
After add this entry to LDAP, we reset the password to "888888"
(5)Test After run test command line
radtest jjeep "888888" localhost 1 testing123
The following is information from running Radiusd -X:
...... rad_recv: Access-Request packet from host 127.0.0.1:32771, id=192, length=57 User-Name = "jjeep" User-Password = "888888" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jjeep", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jjeep radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.0.0.118:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1
970 to 10.0.0.118:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mtcable,dc=net, with
filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for req uest 0 rlm_pap: WARNING! No "known good" password found for the use r. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "jjeep" with password "888888" radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mtcable,dc=net, with
filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [jjeep] (from cl ient localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request
The following is logfile:
...... May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" method=128 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 RESULT tag=97 err=0 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem
May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH attr=uid May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text=
It looks like LDAP search successfully and found 3 entries, but redius server could not find any objects.
What is wrong with my integration?
Thanks In Advanced
Robin
____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks Pshem for your quick answer. I expect answer like folowing "rlm_ldap: user jjeep authenticated succesfully modcall[authenticate]: module "ldap" returns ok" But I got "rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0" Thanks Robin Pshem Kowalczyk wrote:
Freeradius expects exactly one answer: rlm_ldap: object not found or got ambiguous search result
kind regards Pshem
On 22/05/07, xuebin gong <robin_gong@yahoo.com> wrote:
Hi, All,
I am user and want to integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication. Our operating system is Fedora 5 Linux.
(1)Install freeRadius-1.1.6 After following the instruction of installation in http://wwww.freeradius.org, install freeRadius-1.1.6 on Fedora Linux 5, run radius server in debug mode
radiusd -X ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.
FreeRadius was installed succeefully.
(2)Configure freeRadius-1.1.6 (2.1) Configure radiusd.conf (2.1.1) LDAP module ldap{ server = "10.0.0.118" identity = "cn=Manager,dc=mtcable,dc=net" password = mtncnl1970 basedn = "dc=mtcable,dc=net" filter = "uid=%{Stripped-User-Name:-%{User-Name}}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } (2.1.2) authorize module uncomment ldap line
authorize{ ...... ldap ...... }
(2.1.3) authenticate module uncomment block ldap block:
authenticate{ ...... Auth-Type LDAP { ldap } ...... }
(2.2) edit /usr/local/etc/raddb/users Uncomment the following lines:
DEFAULT Auth-Type = LDAP Fall-Through = 1
(3)Install openLDAP (4)Configure openLDAP (5)Add one LDAP entry for testing
dn: uid=jjeep, ou=radius, rccd=AAA3140018f, dc=mtcable,dc=net userPassword:: aabbccdd cn: jeep uid: jjeep radiusAuthType: local radiusSimultaneousUse: 1 homeDirectory: // objectClass: top objectClass: posixAccount objectClass: radiusprofile uidNumber: 7012 gidNumber: 100
After add this entry to LDAP, we reset the password to "888888"
(5)Test After run test command line
radtest jjeep "888888" localhost 1 testing123
The following is information from running Radiusd -X:
...... rad_recv: Access-Request packet from host 127.0.0.1:32771, id=192, length=57 User-Name = "jjeep" User-Password = "888888" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jjeep", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jjeep radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.0.0.118:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1
970 to 10.0.0.118:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mtcable,dc=net, with
filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for req uest 0 rlm_pap: WARNING! No "known good" password found for the use r. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "jjeep" with password "888888" radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mtcable,dc=net, with
filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [jjeep] (from cl ient localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request
The following is logfile:
...... May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" method=128 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 RESULT tag=97 err=0 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem
May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH attr=uid May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text=
It looks like LDAP search successfully and found 3 entries, but redius server could not find any objects.
What is wrong with my integration?
Thanks In Advanced
Robin
____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/Integrate-freeradius-v1.1.6-and-openLADP-v2.3.32-for-a... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (3)
-
Pshem Kowalczyk -
robin gong -
xuebin gong