Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type
I've tried as recommended not to set Auth-Type but trying below will works in 1.1.2 but not on my recently upgraded to 1.1.7 Configs:- ############################ a) radiusd.conf authorize { Autz-Type LDAP { ldap1 } Autz-Type ADSL { ldapadsl1 } } authenticate { Auth-Type ldap1 { ldap1 Auth-Type ldapadsl1 { ldapadsl1 } } b) users DEFAULT Huntgroup-Name == "adsl", ldapadsl1-Ldap-Group == "ADSL", Autz-Type := ADSL DEFAULT Autz-Type := LDAP ################################## Results:- In 1.1.2 - (Auth-Type ldap1 => working!!) ############################################ modcall: leaving group authorize (returns ok) for request 18 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 18 modcall: entering group redundant for request 18 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by dialupAccess rlm_ldap: Added password {CRYPT}XXXXXXXX in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: Setting Auth-Type = ldap1 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 18 modcall: leaving group redundant (returns ok) for request 18 modcall: leaving group LDAP (returns ok) for request 18 rad_check_password: Found Auth-Type ldap1 auth: type "ldap1" ###################################### In 1.1.7 (Auth-Type = Local => not working!!) ########################################## modcall: leaving group authorize (returns ok) for request 1 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by dialupAccess rlm_ldap: Added password {CRYPT}XXXXXXXXXXXXX in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression = Van-Jacobson-TCP-IP rlm_ldap: Adding radiusFramedMTU as Framed-MTU = 1500 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol = PPP rlm_ldap: Adding radiusServiceType as Service-Type = Framed-User rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 modcall: leaving group redundant (returns ok) for request 1 modcall: leaving group LDAP (returns ok) for request 1 auth: type Local auth: user supplied User-Password does NOT match local User-Password ###################################3
Rohaizam Abu Bakar wrote:
I've tried as recommended not to set Auth-Type but trying below will works in 1.1.2 but not on my recently upgraded to 1.1.7
Configs:-
############################ a) radiusd.conf
authorize { Autz-Type LDAP { ldap1 }
Autz-Type ADSL { ldapadsl1 }
Add "pap" here. This is documented in the README in 1.1.7. See also the comments in the default "radiusd.conf" in 1.1.7. Alan DeKok.
Yep.. the "pap" is on the last line in authorize section. --haizam ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, September 13, 2007 12:00 AM Subject: Re: Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type
Rohaizam Abu Bakar wrote:
I've tried as recommended not to set Auth-Type but trying below will works in 1.1.2 but not on my recently upgraded to 1.1.7
Configs:-
############################ a) radiusd.conf
authorize { Autz-Type LDAP { ldap1 }
Autz-Type ADSL { ldapadsl1 }
Add "pap" here.
This is documented in the README in 1.1.7. See also the comments in the default "radiusd.conf" in 1.1.7.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I had the same problem: the ldap module only sets Auth-Type if it do not add a cleartext password to config items (the line saying "rlm_ldap: Added password {CRYPT}XXXXXXXX in check items"). Cannot the password be stored in LDAP directly? Rohaizam Abu Bakar ha scritto:
I've tried as recommended not to set Auth-Type but trying below will works in 1.1.2 but not on my recently upgraded to 1.1.7
Configs:-
############################ a) radiusd.conf
authorize { Autz-Type LDAP { ldap1 }
Autz-Type ADSL { ldapadsl1 }
} authenticate {
Auth-Type ldap1 { ldap1 Auth-Type ldapadsl1 { ldapadsl1 } }
b) users
DEFAULT Huntgroup-Name == "adsl", ldapadsl1-Ldap-Group == "ADSL", Autz-Type := ADSL DEFAULT Autz-Type := LDAP ##################################
Results:-
In 1.1.2 - (Auth-Type ldap1 => working!!)
############################################
modcall: leaving group authorize (returns ok) for request 18 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 18 modcall: entering group redundant for request 18 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by dialupAccess rlm_ldap: Added password {CRYPT}XXXXXXXX in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: Setting Auth-Type = ldap1 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 18 modcall: leaving group redundant (returns ok) for request 18 modcall: leaving group LDAP (returns ok) for request 18 rad_check_password: Found Auth-Type ldap1 auth: type "ldap1"
######################################
In 1.1.7 (Auth-Type = Local => not working!!)
########################################## modcall: leaving group authorize (returns ok) for request 1 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by dialupAccess rlm_ldap: Added password {CRYPT}XXXXXXXXXXXXX in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression = Van-Jacobson-TCP-IP rlm_ldap: Adding radiusFramedMTU as Framed-MTU = 1500 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol = PPP rlm_ldap: Adding radiusServiceType as Service-Type = Framed-User rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 modcall: leaving group redundant (returns ok) for request 1 modcall: leaving group LDAP (returns ok) for request 1 auth: type Local auth: user supplied User-Password does NOT match local User-Password
###################################3
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ivan Lago wrote:
I had the same problem: the ldap module only sets Auth-Type if it do not add a cleartext password to config items (the line saying "rlm_ldap: Added password {CRYPT}XXXXXXXX in check items"). Cannot the password be stored in LDAP directly?
Yes, it can. But if you're telling the server about a "known good" password, it means that the *server* can authenticate the user. Setting "Auth-Type := LDAP" is unnecessary. In many, many, cases, it's also WRONG. Add the "pap" module to the "authorize" section. Alan DeKok.
participants (3)
-
Alan DeKok -
Ivan Lago -
Rohaizam Abu Bakar