Ldap group troubles
I'm having some trouble with the ldap group configuration against AD and need a little help. Freeradius 1.1.4 MS 2003 Active Directory radiusd.conf groupname_attribute = "cn" groupmembership_filter = "(member=%{Ldap-UserDn})" groupmembership_attribute = memberOf users file DEFAULT Ldap-Group == "CN= CSG Group,OU=CSG,OU=ACE,OU=IATS,OU=MU,DC=col,DC=missouri,DC=edu", Auth-Type := LDAP Using ldapsearch as follows I get a match. ldapsearch -x -W -b"CN=Some GROUP,OU=" "(member= CN=Last\\\, First \(Department\),CN=Users,DC=col,DC=missouri,DC=edu)" The userDN actually looks like "CN=Last\, First (Department),CN=Users,DC=col,DC=missouri,DC=edu" but we have escape the \ and the () for bash. Freeradius isn't getting the same results. It looks like it has to do with the fact that the UserDN has a \, and (...) in it. Has anyone else ran into this before? Thanks, Brian Dourty System Administrator - Team Lead Division of IT (formerly IAT Services) University of Missouri - Columbia 573-882-1035
I just got Freeradius up and running I have am having the users online showing user on several times (note below) This is from users online from the query to the radacct table in mysql jldevore 6/5/2007 7:19:55 PM jldevore 6/5/2007 7:19:40 PM jldevore 6/5/2007 7:19:25 PM jldevore 6/5/2007 7:19:10 PM jldevore 6/5/2007 7:18:55 PM This is the Radwho command at appx the same time Login Name What TTY When From Location jldevore jldevore PPP >999 Tue 19:17 209.247.2 4.253.116.100 Anyone got any idea why I am getting this? I am stumped. P.S this is a new install Jeff
These are suspiciously spaced exactly at 15 minutes. Are you inserting accounting updates into radacct table? Ivan Kalik Kalik Informatika ISP Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piše:
I just got Freeradius up and running
I have am having the users online showing user on several times (note below)
This is from users online from the query to the radacct table in mysql
jldevore 6/5/2007 7:19:55 PM jldevore 6/5/2007 7:19:40 PM jldevore 6/5/2007 7:19:25 PM jldevore 6/5/2007 7:19:10 PM jldevore 6/5/2007 7:18:55 PM
This is the Radwho command at appx the same time
Login Name What TTY When From Location jldevore jldevore PPP >999 Tue 19:17 209.247.2 4.253.116.100
Anyone got any idea why I am getting this? I am stumped.
P.S this is a new install
Jeff
to be quite honest not even sure. What must I check to be certain? One thing I do no, the user is offline now, and they still are there in as online same entrys _____ From: tnt@kalik.co.yu To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Tue, 05 Jun 2007 21:45:47 -0400 Subject: Re: Help Users Online Listing Issues These are suspiciously spaced exactly at 15 minutes. Are you inserting accounting updates into radacct table? Ivan Kalik Kalik Informatika ISP Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piše:
I just got Freeradius up and running
I have am having the users online showing user on several times (note below)
This is from users online from the query to the radacct table in mysql
jldevore 6/5/2007 7:19:55 PM jldevore 6/5/2007 7:19:40 PM jldevore 6/5/2007 7:19:25 PM jldevore 6/5/2007 7:19:10 PM jldevore 6/5/2007 7:18:55 PM
This is the Radwho command at appx the same time
Login Name What TTY When From Location jldevore jldevore PPP >999 Tue 19:17 209.247.2 4.253.116.100
Anyone got any idea why I am getting this? I am stumped.
P.S this is a new install
Jeff
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
run radiusd -X and see if these crop up when you recieve accounting update request. If your NAS is sending them as Start, not Update packets you will need to fix it on the NAS. Ivan Kalik Kaliik Informatika ISP Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piše:
to be quite honest not even sure. What must I check to be certain? One thing I do no, the user is offline now, and they still are there in as online same entrys _____
From: tnt@kalik.co.yu To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Tue, 05 Jun 2007 21:45:47 -0400 Subject: Re: Help Users Online Listing Issues
These are suspiciously spaced exactly at 15 minutes. Are you inserting accounting updates into radacct table?
Ivan Kalik Kalik Informatika ISP
Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piĹĄe:
I just got Freeradius up and running
I have am having the users online showing user on several times (note below)
This is from users online from the query to the radacct table in mysql
jldevore 6/5/2007 7:19:55 PM jldevore 6/5/2007 7:19:40 PM jldevore 6/5/2007 7:19:25 PM jldevore 6/5/2007 7:19:10 PM jldevore 6/5/2007 7:18:55 PM
This is the Radwho command at appx the same time
Login Name What TTY When From Location jldevore jldevore PPP >999 Tue 19:17 209.247.2 4.253.116.100
Anyone got any idea why I am getting this? I am stumped.
P.S this is a new install
Jeff
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Just so yoo know these are from another radius server. Virtual isp in specific coming from globalpops If fom anohter radius server makes a difference in whats happening. also i see stop and start packets in detail file, and when looking at the radacct table I see all the accounting info but the acctstoptime and total for that session. But its like the user dropped off and it didn't create or get that the user was gone. jeff _____ From: tnt@kalik.co.yu To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Wed, 06 Jun 2007 06:02:45 -0400 Subject: Re: Help Users Online Listing Issues run radiusd -X and see if these crop up when you recieve accounting update request. If your NAS is sending them as Start, not Update packets you will need to fix it on the NAS. Ivan Kalik Kaliik Informatika ISP Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piše:
to be quite honest not even sure. What must I check to be certain? One thing I do no, the user is offline now, and they still are there in as online same entrys _____
From: tnt@kalik.co.yu To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Tue, 05 Jun 2007 21:45:47 -0400 Subject: Re: Help Users Online Listing Issues
These are suspiciously spaced exactly at 15 minutes. Are you inserting accounting updates into radacct table?
Ivan Kalik Kalik Informatika ISP
Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piĹĄe:
I just got Freeradius up and running
I have am having the users online showing user on several times (note below)
This is from users online from the query to the radacct table in mysql
jldevore 6/5/2007 7:19:55 PM jldevore 6/5/2007 7:19:40 PM jldevore 6/5/2007 7:19:25 PM jldevore 6/5/2007 7:19:10 PM jldevore 6/5/2007 7:18:55 PM
This is the Radwho command at appx the same time
Login Name What TTY When From Location jldevore jldevore PPP >999 Tue 19:17 209.247.2 4.253.116.100
Anyone got any idea why I am getting this? I am stumped.
P.S this is a new install
Jeff
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Problem with remote servers is only if packets are missing. If they are (all) arriving it's no problem at all. Accounting Stop packet should contain Acct-Stop-Time and Acct-Session-Time. Run radiusd -X or radsniff and see what's in those packets. Also have a look if the packets causing problems are not of Interim-Update variety. As I said - they are spaced exactly at 15 minutes. Ivan Kalik Kaliik Informatika ISP Dana 6/6/2007, "Jeff" <jeffa@jahelpdesk.com> piše:
Just so yoo know these are from another radius server. Virtual isp in specific coming from globalpops If fom anohter radius server makes a difference in whats happening.
also i see stop and start packets in detail file, and when looking at the radacct table I see all the accounting info but the acctstoptime and total for that session.
But its like the user dropped off and it didn't create or get that the user was gone.
jeff
To clarify...we are running version 1.4.1. I'll try the latest release anyway. Brian Dourty System Administrator - Team Lead Division of IT (formerly IAT Services) University of Missouri - Columbia 573-882-1035 -----Original Message----- From: freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.o rg] On Behalf Of Phil Mayers Sent: Tuesday, June 05, 2007 6:50 PM To: FreeRadius users mailing list Subject: Re: Ldap group troubles Dourty, Brian R. (IATS) wrote:
I'm having some trouble with the ldap group configuration against AD and need a little help.
Freeradius 1.1.4
Upgrade. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Apparently version numbers and I aren't getting along. It was 1.1.4. I just grabbed the latest 1.1.6 code and compiled it. Same problem. Here is the ldap portion of the debug output: rlm_ldap: performing search in DC=edu, with filter (|(sAMAccountName=dourtyb)(userPrincipalName=dourtyb)) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(member=CN\3dDourty\5c\5c\2c Brian R. \28IATS\29\2cCN\3dUsers\2cDC\3dcol\2cDC\3dmissouri\2cDC\3dedu)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=CSG Group,OU=CSG,OU=ACE,OU=IATS,OU=MU,DC=col,DC=missouri,DC=edu, with filter (member=CN\3dDourty\5c\5c\2c Brian R. \28IATS\29\2cCN\3dUsers\2cDC\3dcol\2cDC\3dmissouri\2cDC\3dedu) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group CN=CSG Group,OU=CSG,OU=ACE,OU=IATS,OU=MU,DC=col,DC=missouri,DC=edu not found or user is not a member. Full debug output: [root@radius-vm-tc1 ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/oraclesql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server.key" tls: certificate_file = "/etc/raddb/certs/server.crt" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded LDAP ldap: server = "x.x.x.x" ldap: port = 3268 ldap: net_timeout = 2 ldap: timeout = 10 ldap: timelimit = 4 ldap: identity = "ldapuser" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "password" ldap: basedn = "DC=edu" ldap: filter = "(|(sAMAccountName=%{User-Name})(userPrincipalName=%{User-Name}))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(member=%{Ldap-UserDn})" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 10 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0xa076960 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x:33108, id=80, length=75 User-Name = "dourtyb" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dourtyb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'DC=edu' radius_xlat: '(|(sAMAccountName=dourtyb)(userPrincipalName=dourtyb))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to x.x.x.x:3268, authentication 0 rlm_ldap: starting TLS rlm_ldap: bind as ldapuser/password to x.x.x.x:3268 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in DC=edu, with filter (|(sAMAccountName=dourtyb)(userPrincipalName=dourtyb)) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(member=CN\3dDourty\5c\5c\2c Brian R. \28IATS\29\2cCN\3dUsers\2cDC\3dcol\2cDC\3dmissouri\2cDC\3dedu)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=CSG Group,OU=CSG,OU=ACE,OU=IATS,OU=MU,DC=col,DC=missouri,DC=edu, with filter (member=CN\3dDourty\5c\5c\2c Brian R. \28IATS\29\2cCN\3dUsers\2cDC\3dcol\2cDC\3dmissouri\2cDC\3dedu) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group CN=CSG Group,OU=CSG,OU=ACE,OU=IATS,OU=MU,DC=col,DC=missouri,DC=edu not found or user is not a member. modcall[authorize]: module "files" returns notfound for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for dourtyb radius_xlat: '(|(sAMAccountName=dourtyb)(userPrincipalName=dourtyb))' radius_xlat: 'DC=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=edu, with filter (|(sAMAccountName=dourtyb)(userPrincipalName=dourtyb)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user dourtyb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dourtyb" with password "password" rlm_ldap: user DN: CN=Dourty\, Brian R. (IATS),CN=Users,DC=col,DC=missouri,DC=edu rlm_ldap: (re)connect to x.x.x.x:3268, authentication 1 rlm_ldap: starting TLS rlm_ldap: bind as CN=Dourty\, Brian R. (IATS),CN=Users,DC=col,DC=missouri,DC=edu/password to x.x.x.x:3268 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dourtyb authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Login OK: [dourtyb] (from client radius-vm-tc1 port 12) Sending Access-Accept of id 80 to x.x.x.x port 33108 Finished request 0 Going to the next request Brian Dourty System Administrator - Team Lead Division of IT (formerly IAT Services) University of Missouri - Columbia 573-882-1035 -----Original Message----- From: freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.o rg] On Behalf Of Dourty, Brian R. (IATS) Sent: Wednesday, June 06, 2007 8:04 AM To: FreeRadius users mailing list Subject: RE: Ldap group troubles To clarify...we are running version 1.4.1. I'll try the latest release anyway. Brian Dourty System Administrator - Team Lead Division of IT (formerly IAT Services) University of Missouri - Columbia 573-882-1035 -----Original Message----- From: freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.o rg] On Behalf Of Phil Mayers Sent: Tuesday, June 05, 2007 6:50 PM To: FreeRadius users mailing list Subject: Re: Ldap group troubles Dourty, Brian R. (IATS) wrote:
I'm having some trouble with the ldap group configuration against AD and need a little help.
Freeradius 1.1.4
Upgrade. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Upgrading is what broke this functionality. It works with version 1.0.1. Sometime after that a change was made to rlm_ldap.c. This change modified the ldap_escape_func() function. The way this function works in 1.1.4 and up is different than 1.0.1. Basically, it didn't escape anything in 1.0.1 and now it does. What we see in 1.1.4/1.1.6 is that a UserDN returned from AD using OpenLDAP looks like this: CN=Lastname\,Firstname, CN=bla,DC=bla After the ldap_escape_func() returns it looks like this: CN\\3dLastname\\5c\\5c\\2cFirstname\\2cCN\\3dbla\\2cDC\\3dbla The \, gets escaped then translated and becomes \\5c\\5c\\2c which doesn't match \, in the member= results of the group. Any ideas where the extra \\5c is coming from? Brian Dourty System Administrator - Team Lead Division of IT University of Missouri - Columbia 573-882-1035 -----Original Message----- From: freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.o rg] On Behalf Of Phil Mayers Sent: Tuesday, June 05, 2007 6:50 PM To: FreeRadius users mailing list Subject: Re: Ldap group troubles Dourty, Brian R. (IATS) wrote:
I'm having some trouble with the ldap group configuration against AD and need a little help.
Freeradius 1.1.4
Upgrade. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dourty, Brian R. (IATS) wrote:
Upgrading is what broke this functionality. It works with version 1.0.1. Sometime after that a change was made to rlm_ldap.c. This change modified the ldap_escape_func() function. The way this function works in 1.1.4 and up is different than 1.0.1. Basically, it didn't escape anything in 1.0.1 and now it does.
What we see in 1.1.4/1.1.6 is that a UserDN returned from AD using OpenLDAP looks like this:
CN=Lastname\,Firstname, CN=bla,DC=bla
After the ldap_escape_func() returns it looks like this:
CN\\3dLastname\\5c\\5c\\2cFirstname\\2cCN\\3dbla\\2cDC\\3dbla
The \, gets escaped then translated and becomes \\5c\\5c\\2c which doesn't match \, in the member= results of the group.
Actually now that you mention it I seem to remember this coming up before, and me giving the same answer to someone else: FreeRadius' ldap_escape_func appears very over-zealous. I believe it's only necessary to escape: * ( ) \ NUL ...when substituting values into LDAP filters. FR escapes in addition to this: , + " <
; = (and not NUL, but of course FR can't actually deal with strings containing embedded nulls. Binary types yes, not strings) See: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg34741.h... And: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg22126.h... Note that the post in that latter thread is wrong - RFC2254 only mandates escaping of the chars in my 1st list, and explicitly not the others. However, RFC2254 does *permit* escaping of other chars. I'm guessing AD doesn't process that however and thus the fault. I'd like to know why FR ldap_escape_func was made more strict - was there an actual problem or was it solving a problem that doesn't actually exist?
participants (4)
-
Dourty, Brian R. (IATS) -
Jeff -
Phil Mayers -
tnt＠kalik.co.yu