Can't add a $ sign to the ldap search
Hi, I tried to change the ldap-searchfilter in the ldap module, to search for a username "user" and "user$" in LDAP, if "user" is given. This is neccecary to authenticate my workstations and users via LDAP. This is my filter definition in the ldap module: filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}\$))" This ist what I get: [ldap] expand: (|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}$)) -> (|(uid=scit-beerchen)(uid=scit-beerchen)) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to physalis:389, authentication 0 [ldap] bind as / to physalis:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (|(uid=scit-beerchen)(uid=scit-beerchen)) [ldap] object not found But the "$" sign is always ignored. I tried also \\$ and some other combinations. But none worked. So I'am doing it the wrong way. How do I add (or escape) the $ into my query? BTW: The query
On 05/23/2011 01:07 PM, Alexandros Gougousoudis wrote:
Hi,
I tried to change the ldap-searchfilter in the ldap module, to search for a username "user" and "user$" in LDAP, if "user" is given. This is neccecary to authenticate my workstations and users via LDAP.
This is my filter definition in the ldap module:
filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}\$))"
Don't do that. Instead try: filter = "(uid=%{mschap:User-Name})" Has there been some article published somewhere recently about how great workstation auth is? We've been getting a lot of queries about it...
Hi Phil, filter =
"(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}\$))"
Don't do that. Instead try:
filter = "(uid=%{mschap:User-Name})"
Hm, this is not working. I also don't get the point, why the username in mschap is mangled to have a $ or not? The Windows-Worstation query their name as "host/workstation", which is workstation$ in my ldap. My Users are coming in as "user", so where else doing the lookup than in ldap module? The "host/" realm is stripped off before. I made now a workaround with ...%{User-Name}}*))" This will match workstation and workstationWHATEVER. Not very elegant, but I assume a bug in the ldap-module, because every other char works, just $ not. If you could explain your point, I might look through it. TIA Alex
On 05/23/2011 08:46 PM, Alexandros Gougousoudis wrote:
Hi Phil, filter =
"(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}\$))"
Don't do that. Instead try:
filter = "(uid=%{mschap:User-Name})"
Hm, this is not working. I also don't get the point, why the username in mschap is mangled to have a $ or not?
The expansion %{mschap:User-Name} will expand as follows: username -> username DOMAIN\username -> username host/name.domain.com -> name$ ...which is correct in the cases people care about, and is the quickest and cleanest way to handle the various forms of usernames that windows sends (On that note: it does not handle user@domain.com. It probably should...)
The Windows-Worstation query their name as "host/workstation", which is workstation$ in my ldap. My Users are coming in as "user", so where else doing the lookup than in ldap module?
The %{mschap:User-Name} module is available anywhere, as long as the mschap module is instantiated. The request doesn't even have to be mschap - it gives back a modified version of the username. If the "$" still isn't getting into the LDAP query, it might be something inside the LDAP module.
Hi Phil, I got the point and it works! Thank you! BTW, any idea why this failes?
DOMAIN\username -> username
The command: radtest -t mschap VERWALTUNG\gougousoudis testpwd 127.0.0.1:1812 0 testing123 gives this output. It seems, that the "\" doesn't come through (i use bash-shell). Even escaping with \\ didn't work. rad_recv: Access-Request packet from host 127.0.0.1 port 49087, id=21, length=130 User-Name = "VERWALTUNGgougousoudis" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 MS-CHAP-Challenge = 0x9c8b269ebf5831c3 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000231e6b56bbfa62485bd1e5658b1843758a4b35af52fabc16 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "VERWALTUNGgougousoudis", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "VERWALTUNGgougousoudis", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for VERWALTUNGgougousoudis [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{mschap:User-Name} -> VERWALTUNGgougousoudis [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{mschap:User-Name}}) -> (uid=VERWALTUNGgougousoudis) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (uid=VERWALTUNGgougousoudis) [ldap] object not found Thanks Alex
On 24/05/11 09:57, Alexandros Gougousoudis wrote:
Hi Phil,
I got the point and it works! Thank you!
BTW, any idea why this failes?
DOMAIN\username -> username
The command:
radtest -t mschap VERWALTUNG\gougousoudis testpwd 127.0.0.1:1812 0 testing123
gives this output. It seems, that the "\" doesn't come through (i use bash-shell). Even escaping with \\ didn't work.
Well, you need to fix that first, obviously. FreeRadius is probably eating the "\" itself e.g. above, seeing "\g" and ouputting "g" Try: radtest -r mschap 'DOMAIN\\name'
participants (2)
-
Alexandros Gougousoudis -
Phil Mayers