freeradius failed to authenticate the users against windos active directory
Hi there, I had the issue when I tried to configure my freeradius server integrate windows 2008 R2 Active directory authentication. It worked before when it connected to a Windows AD 2003. However after I switched the AD server to a new AD server which is in another Windows domain (windows 2008 R2) , it's broken. Looks like the radius server doesn't forward the request to the AD server even it has no Mysql database or local user database. The request was rejected then. All the AD integration configuration files are in place and I don't find any mistakes. The only change I made is upgrading the samba version from 2.x to 3.5.4 because the old version can't build up pipe to windows 2008 R2 domain controller. 1. The radius server has already joined the windows 2008 R2 domain. I can look up the AD information without problem. a. Samba version: [root@GTK_RADIUS /]#smbd -V Version 3.5.4-0.83.el5 b. authenticate a user from the domain [root@GTK_RADIUS /]#wbinfo -a exie%123456 plaintext password authentication failed Could not authenticate user exie%123456 with plaintext password challenge/response password authentication succeeded c. authenticate with NTLM [root@GTK_RADIUS /]#ntlm_auth .-request-nt-key --domain=NE --username=exie password: NT_STATUS_OK: Success (0x0) 2. The Log of Radius authentication is attached. Could you kindly to help me figure out why the freeradius server can't work with windows AD? Thanks so much in advance. Edward Xie The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.
Edward Xie wrote:
Could you kindly to help me figure out why the freeradius server can’t work with windows AD? Thanks so much in advance.
It has nothing to do with AD. Read the debug log. Honestly, this isn't hard: [sql] expand: %{User-Name} -> host/NetEng-D410.NE.LOCAL [sql] sql_set_user escaped user --> 'host/NetEng-D410.NE.LOCAL' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 ++[sql] returns fail Invalid user: [host/NetEng-D410.NE.LOCAL/<via Auth-Type = EAP>] (from client 0.0.0.0/0 port 3 cli 00-14-22-fd-dd-98) Your SQL server is down. Fix it. Alan DeKok.
Hello, Thanks for your answer. However I don't want to use Mysql database to authenticate the user. That's why Mysql database was not turned on with Freeradius. I just want to use Microsoft Active Directory to authenticate the user. However from the log, I don't see the radius server ever tried querying AD server. That is the issue which I want to figure out. Regards, Edward Xie -----Original Message----- From: freeradius-users-bounces+edward.xie=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+edward.xie=guest-tek.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: February-25-14 4:31 PM To: FreeRadius users mailing list Subject: Re: freeradius failed to authenticate the users against windos active directory Edward Xie wrote:
Could you kindly to help me figure out why the freeradius server can’t work with windows AD? Thanks so much in advance.
It has nothing to do with AD. Read the debug log. Honestly, this isn't hard: [sql] expand: %{User-Name} -> host/NetEng-D410.NE.LOCAL [sql] sql_set_user escaped user --> 'host/NetEng-D410.NE.LOCAL' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 ++[sql] returns fail Invalid user: [host/NetEng-D410.NE.LOCAL/<via Auth-Type = EAP>] (from client 0.0.0.0/0 port 3 cli 00-14-22-fd-dd-98) Your SQL server is down. Fix it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Edward Xie wrote:
Thanks for your answer. However I don't want to use Mysql database to authenticate the user. That's why Mysql database was not turned on with Freeradius.
Well... you enabled MySQL. It's not part of the default configuration. Why did you enable it when you don't want to use it? Why is it *still* enabled when you don't want to use it?
I just want to use Microsoft Active Directory to authenticate the user. However from the log, I don't see the radius server ever tried querying AD server. That is the issue which I want to figure out.
Because you didn't configure FreeRADIUS to use AD. Follow this guide. It WILL work: http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.
hi, you've configured your server to use SQL (MySQL) - thats not default config - and the SQL isnt working - so the server fails. Either fix the SQL issue or remove the calls to SQL in the server config files that you've got enabled alan
Alan, Probably you are right. Now I have fixed the issue. Simply I removed the freeradius & mysql from the server and then reinstalled the freeradius from yum installation. Then I followed the http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOW... to configure all the necessary configuration file (not enable mysql database). Then it worked. Thanks everybody for your kind help! Regards, Edward Xie -----Original Message----- From: freeradius-users-bounces+edward.xie=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+edward.xie=guest-tek.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: February-26-14 1:47 AM To: FreeRadius users mailing list Subject: Re: freeradius failed to authenticate the users against windos active directory hi, you've configured your server to use SQL (MySQL) - thats not default config - and the SQL isnt working - so the server fails. Either fix the SQL issue or remove the calls to SQL in the server config files that you've got enabled alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Probably you are right.
No, he was definitely right, there's no 'probably'. It's not fucking magic, there are no evil pixies lurking in the code that just randomly decided to target your installation. If you list a module which depends on an external resource like a database, and it cannot connect to that external resource, it *WILL* return fail, and then with the default config that *WILL* result in the server sending an Access-Reject. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Edward Xie