Freeradius+AD - Login with EmployeeID
Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname. This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) Now I need to enable the users to login with the employeeID. This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})" The filter works in ldapsearch but not in freeradius. # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail Mon Aug 7 10:23:44 2023 : Debug: +} # group authorize = fail Mon Aug 7 10:23:44 2023 : Debug: Using Post-Auth-Type REJECT Mon Aug 7 10:23:44 2023 : Debug: # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group REJECT { Mon Aug 7 10:23:44 2023 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 1638828 Mon Aug 7 10:23:44 2023 : Debug: ++[attr_filter.access_reject] = updated Mon Aug 7 10:23:44 2023 : Debug: +} # group REJECT = updated Why freeradius can't filter with the employeeID attribute? Thanks.
On Aug 7, 2023, at 10:01 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname.
This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}})
Now I need to enable the users to login with the employeeID.
This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})"
The filter works in ldapsearch but not in freeradius.
OK...
# Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail ... Why freeradius can't filter with the employeeID attribute?
It can. The filters you're giving to FreeRADIUS are different from the filters you're using in ldapsearch. There are instructions in mods-available/ldap which say how to take the filters, etc. from the ldap module configuration, and then use them in ldapsearch. This lets you debug the exact parameters used by the server. And which version are you running? That debug output looks very old. If you're running a version which is 5+ years old... please upgrade. It will be much better. Alan DeKok.
These are the filters I'm using: filter in freeradius (work) = (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) filter in ldapsearch (work) = (sAMAccountName=rodrigoantunes) filter in freeradius (don't work) = (employeeID=%{mschap_default:User-Name:-%{User-Name}}) filter in ldap search (work) = (employeeID=1638828) The expanded filters in the logs are right, so I don't know why it isn't working; The FreeRADIUS version is 2.2.5. I know it is old, we are currently working on a new one, but we need to make this work until the new is ready. Citando Alan DeKok <aland@deployingradius.com>:
On Aug 7, 2023, at 10:01 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname.
This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}})
Now I need to enable the users to login with the employeeID.
This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})"
The filter works in ldapsearch but not in freeradius.
OK...
# Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail ... Why freeradius can't filter with the employeeID attribute?
It can. The filters you're giving to FreeRADIUS are different from the filters you're using in ldapsearch.
There are instructions in mods-available/ldap which say how to take the filters, etc. from the ldap module configuration, and then use them in ldapsearch. This lets you debug the exact parameters used by the server.
And which version are you running? That debug output looks very old. If you're running a version which is 5+ years old... please upgrade. It will be much better.
Alan DeKok.
-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 7, 2023, at 10:33 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
These are the filters I'm using:
filter in freeradius (work) = (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) filter in ldapsearch (work) = (sAMAccountName=rodrigoantunes)
filter in freeradius (don't work) = (employeeID=%{mschap_default:User-Name:-%{User-Name}}) filter in ldap search (work) = (employeeID=1638828)
Those aren't the filters that FreeRADIUS is using. Those are the *input* configuration items to FreeRADIUS, before the filters are expanded.
The expanded filters in the logs are right, so I don't know why it isn't working;
Download v3, then read the documentation in mods-available/ldap. Follow the instructions for copying the FreeRADIUS configuration items to the ldapsearch parameters.
The FreeRADIUS version is 2.2.5. I know it is old, we are currently working on a new one, but we need to make this work until the new is ready.
It's probably less work to upgrade, than to fight an old system. It's really not useful for anyone here to debug / fix a version of software which is 10+ years old. Any issues have been found and fixed many years ago. We're not going to work through that effort again. Alan DeKok.
Isn't the expanded filters in the logs the filters that freeradius is using? I did what you said about the ldapsearch parameters, I can confirm that everything is in order. I thought this was a simple configuration that would work in any version, thanks for let me know it isn't so simple and that it may be related to the freeradius version. Thanks for the help. Citando Alan DeKok <aland@deployingradius.com>:
On Aug 7, 2023, at 10:33 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
These are the filters I'm using:
filter in freeradius (work) = (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) filter in ldapsearch (work) = (sAMAccountName=rodrigoantunes)
filter in freeradius (don't work) = (employeeID=%{mschap_default:User-Name:-%{User-Name}}) filter in ldap search (work) = (employeeID=1638828)
Those aren't the filters that FreeRADIUS is using. Those are the *input* configuration items to FreeRADIUS, before the filters are expanded.
The expanded filters in the logs are right, so I don't know why it isn't working;
Download v3, then read the documentation in mods-available/ldap.
Follow the instructions for copying the FreeRADIUS configuration items to the ldapsearch parameters.
The FreeRADIUS version is 2.2.5. I know it is old, we are currently working on a new one, but we need to make this work until the new is ready.
It's probably less work to upgrade, than to fight an old system.
It's really not useful for anyone here to debug / fix a version of software which is 10+ years old. Any issues have been found and fixed many years ago. We're not going to work through that effort again.
Alan DeKok.
-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 7, 2023, at 12:04 PM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Isn't the expanded filters in the logs the filters that freeradius is using?
Yes,
I did what you said about the ldapsearch parameters, I can confirm that everything is in order.
Well, something is different between ldapsearch and the FreeRADIUS configuration.
I thought this was a simple configuration that would work in any version, thanks for let me know it isn't so simple and that it may be related to the freeradius version.
Try 3.2. If it works, then the issue is v2.x magic, and you can move on. Alan DeKok.
participants (2)
-
Alan DeKok -
Rodrigo Abrantes Antunes