Version: FreeRADIUS 2.0.4 I read the configuration file comments, searched the forums, and even read the source code for rlm_checkval, but am still having trouble getting it working the way I think it should. I am somewhat new to this, so perhaps I missed something obvious. I have an LDAP database. I do have LDAP authentication working without checkval. In the LDAP database, we have an attribute named 'host' that is meant to be a list of NAS IP addresses. This attribute is of type string and multi-valued. A sample LDAP entry might look something like this: dn: uid=testuser,ou=people,o=company host: 192.168.0.1 host: 192.168.0.2 host: 192.168.0.3 I added this to the ldap.attrmap file: checkItem NAS-IP-Address host and then added this to the radiusd.conf file: checkval hostaccess { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = string notfound-reject = yes } and then added 'hostaccess' after 'ldap' in the authorize section of sites-available/default file. When I perform a test (like this): radtest testuser testpass localhost 10 testing123 I get the following 'radiusd -X' output: [...] Listening on authentication address * port 1812 Listening on accounting address * port 1813 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 192.168.0.1 NAS-Port = 10 [...] rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=unt, with filter (uid=testuser) rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute host as RADIUS attribute NAS-IP-Address == 192.168.0.1 rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: ???? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.1 rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.2 rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.3 ++[hostaccess] returns reject Invalid user (rlm_checkval: This NAS-IP-Address is not allowed for the user): [testuser/testpass] (from client localhost port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 2 seconds [...] The "Item Name: NAS-IP-Address, Value: ????" bothered me a bit. I don't understand what that means. I think that should show the value from the Access-Request message, but "????" did not make any sense. There is a value present in the request, otherwise it would reject for a missing VP. The value is clearly there. Now I tried changing to 'data-type = ipaddr' in the checkval configuration, but that seems to be ignored in the source code. The source code seems to compare only string, octet, date, and integer and ignores other types simply returning noop. How should I correctly check that the NAS-IP-Address is listed in the LDAP database's 'host' attribute? Respectfully, Yancey
Yeargan Yancey wrote:
I read the configuration file comments, searched the forums, and even read the source code for rlm_checkval, but am still having trouble getting it working the way I think it should. I am somewhat new to this, so perhaps I missed something obvious.
Please try explaining the requirements, not why your chosen solution doesn't work.
In the LDAP database, we have an attribute named 'host' that is meant to be a list of NAS IP addresses. This attribute is of type string and multi-valued.
That makes it more difficult.
A sample LDAP entry might look something like this:
dn: uid=testuser,ou=people,o=company host: 192.168.0.1 host: 192.168.0.2 host: 192.168.0.3
I added this to the ldap.attrmap file:
checkItem NAS-IP-Address host
Don't. Just don't. NAS-IP-Address is sent by the NAS in a RADIUS packet. Don't overload it to mean something else.
How should I correctly check that the NAS-IP-Address is listed in the LDAP database's 'host' attribute?
By doing an LDAP query. You can use the NAS-IP-Address attribute as part of an LDAP query, to see if it exists: if (%{ldap: blah... dn=blah,host = %{NAS-IP-Address}} == blah) { stuff } Alan DeKok.
Please try explaining the requirements, not why your chosen solution doesn't work.
I did explain the requirements in the message. I meant to be very clear that I had researched the issue and was not asking for a solution without first doing my homework. I tried to find a solution, but the documentation is not very thorough.
I added this to the ldap.attrmap file: checkItem NAS-IP-Address host
Don't. Just don't. NAS-IP-Address is sent by the NAS in a RADIUS packet.
Yes, I know that NAS-IP-Address is sent by the NAS in a RADIUS packet. From the documentation, I understood that ldap.attrmap allows one to 1) Include values from the database in the RADIUS reply [replyItem]. or 2) Compare values from the RADIUS request to values in the database [checkItem]. Is that not correct? If not, then what is the purpose of the checkvar module? The LDAP query solution does work, even though it seems quite a mess in the configuration files. Thanks for that solution. Yancey
I added this to the ldap.attrmap file: checkItem NAS-IP-Address host
Don't. Just don't. NAS-IP-Address is sent by the NAS in a RADIUS packet.
Yes, I know that NAS-IP-Address is sent by the NAS in a RADIUS packet. From the documentation, I understood that ldap.attrmap allows one to
There already is a mapping for NAS-IP-Address as radiusNASIpAddress. Ivan Kalik Kalik Informatika ISP
participants (4)
-
Alan DeKok -
Ivan Kalik -
Yeargan Yancey -
Yeargan, Yancey