ldap configuration & the mysterious filter ="(uid=%u)"
Good afternoon. I've been searching for an answer this issue on a new install of freeradius on CentOS 7, installed from RPMs. As far as I can see, what I enter for the ldap filter is not being used by the server, but I'm hopeful I've missed some detail in the configuration. Here' the key error in the output from radiusd -X. *(0) ERROR: ldap : (uid=%u)* *(0) ERROR: ldap : ^ Invalid variable expansion* *(0) ERROR: ldap : Unable to create filter* [root@kukulcan raddb]# grep -r '%u' [root@kukulcan raddb]# grep -r '\%u' [root@kukulcan raddb]# radiusd -v radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT [root@kukulcan raddb]# yum list freeradius\* Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: centos.host-engine.com * extras: centos.den.host-engine.com * updates: centos.mirror.ndchost.com Installed Packages freeradius.x86_64 3.0.4-6.el7 @base freeradius-devel.x86_64 3.0.4-6.el7 @base freeradius-doc.x86_64 3.0.4-6.el7 @base freeradius-krb5.x86_64 3.0.4-6.el7 @base freeradius-ldap.x86_64 3.0.4-6.el7 @base freeradius-mysql.x86_64 3.0.4-6.el7 @base freeradius-perl.x86_64 3.0.4-6.el7 @base freeradius-postgresql.x86_64 3.0.4-6.el7 @base freeradius-python.x86_64 3.0.4-6.el7 @base freeradius-sqlite.x86_64 3.0.4-6.el7 @base freeradius-unixODBC.x86_64 3.0.4-6.el7 @base freeradius-utils.x86_64 3.0.4-6.el7 @base Available Packages freeradius-devel.i686 3.0.4-6.el7 base /etc/raddb/mods-enables/ldap: [...] ldap { server = "ldap.eckerd.edu" identity = "cn=directory manager" password = ********* basedn = "dc=eckerd,dc=edu" * filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"* #base_filter = "(objectclass=radiusprofile)" [...] [root@kukulcan ~]# grep '%u' /etc/raddb/mods-enabled/ldap [root@kukulcan ~]# LDAP output from radiusd -X [...] # Loaded module rlm_ldap # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "ldap.eckerd.edu" port = 389 password = <<< secret >>> identity = "cn=directory manager" user { * filter = "(uid=%u)"* scope = "sub" base_dn = "" access_positive = yes } group { scope = "sub" base_dn = "" name_attribute = "cn" cacheable_name = no cacheable_dn = no } client { scope = "sub" base_dn = "" attribute { identifier = "host" shortname = "cn" } } profile { filter = "(&)" } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { start_tls = no } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to ldap.eckerd.edu:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful [...] Received Access-Request Id 44 from 127.0.0.1:44847 to 127.0.0.1:1812 length 77 User-Name = 'moorewr' User-Password = 'foobar' NAS-IP-Address = 198.187.214.151 NAS-Port = 0 Message-Authenticator = 0x6a42189a2e73e4a2d624012f4ab82ce3 (0) Received Access-Request packet from host 127.0.0.1 port 44847, id=44, length=77 (0) User-Name = 'moorewr' (0) User-Password = 'foobar' (0) NAS-IP-Address = 198.187.214.151 (0) NAS-Port = 0 (0) Message-Authenticator = 0x6a42189a2e73e4a2d624012f4ab82ce3 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { rlm_ldap (ldap): Reserved connection (4) *(0) ERROR: ldap : (uid=%u)* *(0) ERROR: ldap : ^ Invalid variable expansion* *(0) ERROR: ldap : Unable to create filter* rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 259 seconds rlm_ldap (ldap): You probably need to lower "min" (0) [ldap] = invalid (0) } # authorize = invalid (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> moorewr (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 127.0.0.1 port 44847, id=44, length=0 Sending Access-Reject Id 44 from 127.0.0.1:1812 to 127.0.0.1:44847 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 44 with timestamp +259 -- +-----------------------------------------------------------------+ Walter R. Moore -- Sr. Systems Administrator, Eckerd College moorewr@eckerd.edu -- http://home.eckerd.edu/~moorewr "It was glorious to see -- if your heart were iron, And you could keep from grieving at all the pain" - The Iliad (13.355) I'm on twitter: http://twitter.com/moorewreckerd ***Reminder! ITS will never ask you to e-mail your password!***
On Feb 9, 2016, at 1:40 PM, Walter Moore <moorewr@eckerd.edu> wrote:
I've been searching for an answer this issue on a new install of freeradius on CentOS 7, installed from RPMs. As far as I can see, what I enter for the ldap filter is not being used by the server, but I'm hopeful I've missed some detail in the configuration.
It's not a new install. You have configuration left over from an old version of FreeRADIUS. Or, you edited the configuration and broke it.
Here' the key error in the output from radiusd -X.
*(0) ERROR: ldap : (uid=%u)* *(0) ERROR: ldap : ^ Invalid variable expansion* *(0) ERROR: ldap : Unable to create filter*
That's old syntax. For v3, the default in mods-available/ldap is: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Please use the default configuration files. Alan DeKok.
Mr. DeKok, On this new install of freeradius I used the ldap config suggested by this page: http://wiki.freeradius.org/modules/rlm_ldap Note that on this page, as in my prior config, the listed entry for filter is *filter = "(uid=%{%{Stripped-User-Name}:**-%{User-Name}})"* I erased that an made a copy of mods-available/ldap and no longer have the issue with the incorrect filter in radiusd -X output. There seem to be some problems with this page, and some general gaps in documentation for enabling modules.. for example this search returns no results. http://wiki.freeradius.org/search?q=enable+module On Tue, Feb 9, 2016 at 2:09 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 9, 2016, at 1:40 PM, Walter Moore <moorewr@eckerd.edu> wrote:
I've been searching for an answer this issue on a new install of freeradius on CentOS 7, installed from RPMs. As far as I can see, what I enter for the ldap filter is not being used by the server, but I'm hopeful I've missed some detail in the configuration.
It's not a new install. You have configuration left over from an old version of FreeRADIUS.
Or, you edited the configuration and broke it.
Here' the key error in the output from radiusd -X.
*(0) ERROR: ldap : (uid=%u)* *(0) ERROR: ldap : ^ Invalid variable expansion* *(0) ERROR: ldap : Unable to create filter*
That's old syntax. For v3, the default in mods-available/ldap is:
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
Please use the default configuration files.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- +-----------------------------------------------------------------+ Walter R. Moore -- Sr. Systems Administrator, Eckerd College moorewr@eckerd.edu -- http://home.eckerd.edu/~moorewr "It was glorious to see -- if your heart were iron, And you could keep from grieving at all the pain" - The Iliad (13.355) I'm on twitter: http://twitter.com/moorewreckerd ***Reminder! ITS will never ask you to e-mail your password!***
On Feb 9, 2016, at 2:43 PM, Walter Moore <moorewr@eckerd.edu> wrote:
On this new install of freeradius I used the ldap config suggested by this page: http://wiki.freeradius.org/modules/rlm_ldap
That's for version 2. I'll edit it to make that more clear. But in general, it's *really* not a good idea to just blow away the entire configuration, and replace it with an example from the documentation. The point of the example configuration file is for you to *read it*, and make *minor changes*. See "man radiusd" for instructions. Destroying the configuration is just... unhelpful.
Note that on this page, as in my prior config, the listed entry for filter is *filter = "(uid=%{%{Stripped-User-Name}:**-%{User-Name}})"*
And that's what you should have used. It should also be a hint that running the *default* configuration works, and running a *butchered* configuration doesn't work.
There seem to be some problems with this page, and some general gaps in documentation for enabling modules.. for example this search returns no results. http://wiki.freeradius.org/search?q=enable+module
Feel free to make suggestions. But if you read raddb/mods-available/README.rst, you'll see that this *is* documented. The main problem with most of the documentation is that people look everywhere else... but not where the documentation is located. Alan DeKok.
Ahem. It's up to you how you choose to respond to users. Does it make more sense to see why people who make good faith efforts to follow your documentation are having problems and improve the product? Or should you make negative assumptions, and blame and castigate them for their efforts to follow installation instructions? Regards, Walter Moore On Tue, Feb 9, 2016 at 3:13 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 9, 2016, at 2:43 PM, Walter Moore <moorewr@eckerd.edu> wrote:
On this new install of freeradius I used the ldap config suggested by this page: http://wiki.freeradius.org/modules/rlm_ldap
That's for version 2. I'll edit it to make that more clear.
But in general, it's *really* not a good idea to just blow away the entire configuration, and replace it with an example from the documentation.
The point of the example configuration file is for you to *read it*, and make *minor changes*. See "man radiusd" for instructions.
Destroying the configuration is just... unhelpful.
Note that on this page, as in my prior config, the listed entry for filter is *filter = "(uid=%{%{Stripped-User-Name}:**-%{User-Name}})"*
And that's what you should have used. It should also be a hint that running the *default* configuration works, and running a *butchered* configuration doesn't work.
There seem to be some problems with this page, and some general gaps in documentation for enabling modules.. for example this search returns no results. http://wiki.freeradius.org/search?q=enable+module
Feel free to make suggestions.
But if you read raddb/mods-available/README.rst, you'll see that this *is* documented.
The main problem with most of the documentation is that people look everywhere else... but not where the documentation is located.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- +-----------------------------------------------------------------+ Walter R. Moore -- Sr. Systems Administrator, Eckerd College moorewr@eckerd.edu -- http://home.eckerd.edu/~moorewr "It was glorious to see -- if your heart were iron, And you could keep from grieving at all the pain" - The Iliad (13.355) I'm on twitter: http://twitter.com/moorewreckerd ***Reminder! ITS will never ask you to e-mail your password!***
On Feb 9, 2016, at 3:20 PM, Walter Moore <moorewr@eckerd.edu> wrote:\
Does it make more sense to see why people who make good faith efforts to follow your documentation are having problems and improve the product?
Did I *immediately* fix the Wiki? Yes? Then don't castigate me for not improving the product.
Or should you make negative assumptions, and blame and castigate them for their efforts to follow installation instructions?
Did the instructions on the wiki say to blow away your configuration, and replace it with the one from the Wiki? No? Then don't tell me you followed instructions. This list is for people who want to solve problems. If you're going to complain about people helping you, then no one here will help you. Alan DeKok.
OK, Alan, you clearly made your choice. On Tue, Feb 9, 2016 at 3:25 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 9, 2016, at 3:20 PM, Walter Moore <moorewr@eckerd.edu> wrote:\
Does it make more sense to see why people who make good faith efforts to follow your documentation are having problems and improve the product?
Did I *immediately* fix the Wiki?
Yes?
Then don't castigate me for not improving the product.
Or should you make negative assumptions, and blame and castigate them for their efforts to follow installation instructions?
Did the instructions on the wiki say to blow away your configuration, and replace it with the one from the Wiki?
No?
Then don't tell me you followed instructions.
This list is for people who want to solve problems. If you're going to complain about people helping you, then no one here will help you.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- +-----------------------------------------------------------------+ Walter R. Moore -- Sr. Systems Administrator, Eckerd College moorewr@eckerd.edu -- http://home.eckerd.edu/~moorewr "It was glorious to see -- if your heart were iron, And you could keep from grieving at all the pain" - The Iliad (13.355) I'm on twitter: http://twitter.com/moorewreckerd ***Reminder! ITS will never ask you to e-mail your password!***
On Feb 9, 2016, at 3:30 PM, Walter Moore <moorewr@eckerd.edu> wrote: ... And... he emailed me repeatedly off-list with more complaints. He's been unsubscribed from the list, and banned. To be clear: people who follow instructions will get helped. People who ask good questions will get helped. People who get upset that someone *dared* to tell them they made a mistake will get told "stop complaining, follow instructions, or get banned". I dislike banning people. I had an unofficial "no ban" policy for the first 10 years of running this list. However, the sheer number of people who prioritize complaining over fixing problems became unsustainable. No reasonable adult should get upset at being told "You made a mistake, go back and fix it." As such, unreasonable adults are removed from this list. Alan DeKok.
Just to clear up why it worked after replacing the broken configuration with the working one... On Tue, Feb 09, 2016 at 01:40:00PM -0500, Walter Moore wrote:
/etc/raddb/mods-enables/ldap: [...] ldap { server = "ldap.eckerd.edu" identity = "cn=directory manager" password = ********* basedn = "dc=eckerd,dc=edu" * filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"*
This is old v2 config, filter= is directly in the ldap{} section, not in the user{} sub-section.
LDAP output from radiusd -X ldap { server = "ldap.eckerd.edu" port = 389 password = <<< secret >>> identity = "cn=directory manager"
This:
user { * filter = "(uid=%u)"*
... is in the user{} subsection. On Tue, Feb 09, 2016 at 02:09:21PM -0500, Alan DeKok wrote:
It's not a new install. You have configuration left over from an old version of FreeRADIUS.
Exactly. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (3)
-
Alan DeKok -
Matthew Newton -
Walter Moore