freeradius 2.1.7-7.el5 - How to get vendor specific attributes from LDAP
Hello, please can anybody give me a hint how to get vendor specific atributes from LDAP and send it to the NAS? My freeradius version is 2.1.7-7.el5. When I authenticate against the users file, everything works well. rad_recv: Access-Request packet from host 31.186.188.2 port 60528, id=101, length=73 User-Name = "rad-oper" User-Password = "rad-oper" NAS-Identifier = "ar-srx100-default" NAS-IP-Address = 31.186.188.2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rad-oper", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry rad-oper at line 53 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "rad-oper" [pap] Using clear text password "rad-oper" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 101 to 31.186.188.2 port 60528 Juniper-Local-User-Name := "class2" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 101 with timestamp +302 Ready to process requests. As you can see, I need to send Vendor Specific Attribute : Juniper-Local-User-Name := "class2" which is associated with group of availalble commands on device. On OpenLDAP I edited the schema and added attributetype ( 1.3.6.1.1.1.1.28 NAME 'radiusJuniperLocalUserName' DESC 'Juniper Auth Class' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( 1.3.6.1.1.1.2.13 NAME 'radiusprofile' DESC 'Abstraction of an account with RADIUS attributes' SUP top AUXILIARY MAY radiusJuniperLocalUserName ) Then I've added theese items to my test user "pech". On freeradius server I've edited: 1. ldap.attrmap checkItem Juniper-Local-User-Name radiusJuniperLocalUserName replyItem Juniper-Local-User-Name radiusJuniperLocalUserName 2. modules/ldap ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "10.10.x.y" identity = "cn=sa,dc=viphone,dc=eu" password = testtest basedn = "dc=viphone,dc=eu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)" Now when I try to authenticate LDAP user "pech" I'll get: rad_recv: Access-Request packet from host 31.186.188.2 port 60647, id=85, length=69 User-Name = "pech" User-Password = "securepassword" NAS-Identifier = "ar-srx100-default" NAS-IP-Address = 31.186.188.2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "pech", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "securepassword" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 85 to 31.186.188.2 port 60647 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 85 with timestamp +17 Ready to process requests. So the user is authenticated but no Juniper-Local-User-Name attribute have been sent. Thank you very much for your help. Kind regards, Jakub Pech System Developer ------------------ Spinoco Czech Republic, a.s. Šafránkova 1243/3 155 00 Praha 5 tel +420 257 895 495 jakub.pech@spinoco.com www.spinoco.com Spinoco – firemní komunikace
Jakub Pech wrote:
please can anybody give me a hint how to get vendor specific atributes from LDAP and send it to the NAS? My freeradius version is 2.1.7-7.el5.
See the ldap.attrmap file. This is documented. VSAs are just attributes. Use the name. Nothing else needs to be done.
When I authenticate against the users file, everything works well. ... So the user is authenticated but no Juniper-Local-User-Name attribute have been sent.
Well... where did you define it? Alan DeKok.
Hi,
See the ldap.attrmap file. This is documented. I sent the rows I've added to ldap.attrmap in my previous mail. Is there anything wrong??
Well... where did you define it? First in users file for testing purposes. Worked OK. Then in LDAP.
Thanks Jakub Dne 24.11.11 13:08, Alan DeKok napsal(a):
Jakub Pech wrote:
please can anybody give me a hint how to get vendor specific atributes from LDAP and send it to the NAS? My freeradius version is 2.1.7-7.el5. See the ldap.attrmap file. This is documented.
VSAs are just attributes. Use the name. Nothing else needs to be done.
When I authenticate against the users file, everything works well. ... So the user is authenticated but no Juniper-Local-User-Name attribute have been sent. Well... where did you define it?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, Nov 24, 2011 at 7:30 PM, Jakub Pech <jakub.pech@spinoco.com> wrote:
Hi,
See the ldap.attrmap file. This is documented. I sent the rows I've added to ldap.attrmap in my previous mail. Is there anything wrong??
Normally an ldap attribute will be translated as a radius check or reply item, not both (which is what you did). -- Fajar
Hi,
Normally an ldap attribute will be translated as a radius check or reply item, not both (which is what you did). First I had only "radius check". I added "radius reply" later while testing. I'm almost sure that that is not the cause of my problem.
Please can anybody send me the steps to get some attribute from LDAP server? Mayby I've only missed some configuration step or something like that. 1. Do I have to run the LDAP service on the same server as I'm running freeradius? 2. Do I have to add my LDAP schema to some freeradius configuration file? I did: 1/set up the connection with remote LDAP server 2/set radius check item in ldap.attrmap. Thanks for the help, I'm googling it 4th day in a row. Jakub Dne 24.11.11 13:37, Fajar A. Nugraha napsal(a):
On Thu, Nov 24, 2011 at 7:30 PM, Jakub Pech<jakub.pech@spinoco.com> wrote:
Hi,
See the ldap.attrmap file. This is documented. I sent the rows I've added to ldap.attrmap in my previous mail. Is there anything wrong?? Normally an ldap attribute will be translated as a radius check or reply item, not both (which is what you did).
On Thu, Nov 24, 2011 at 9:43 PM, Jakub Pech <jakub.pech@spinoco.com> wrote:
Hi,
Normally an ldap attribute will be translated as a radius check or reply item, not both (which is what you did).
First I had only "radius check". I added "radius reply" later while testing. I'm almost sure that that is not the cause of my problem.
Why are you doing that? Your "working" debug log says Sending Access-Accept of id 101 to 31.186.188.2 port 60528 Juniper-Local-User-Name := "class2" Finished request 0. Something that you send to the NAS is a reply item. Why did you put it as radius check? And if you're sure it's not the problem (meaning you already know what the source of problem is), then why ask here? -- Fajar
Dne 24.11.11 22:27, Fajar A. Nugraha napsal(a):
Hi,
Normally an ldap attribute will be translated as a radius check or reply item, not both (which is what you did). First I had only "radius check". I added "radius reply" later while testing. I'm almost sure that that is not the cause of my problem.
Why are you doing that? Your "working" debug log says
Sending Access-Accept of id 101 to 31.186.188.2 port 60528 Juniper-Local-User-Name := "class2" Finished request 0. This is the log from testing to authenticate user against the users file. My problem is that I'm not able to do the same against the LDAP.
Something that you send to the NAS is a reply item. Why did you put it as radius check? And if you're sure it's not the problem (meaning you already know what the source of problem is), then why ask here? First I undrestanded that the radius check are items that radius checks in LDAP. But since I havent found any documentation to ldap.attrmap file (i found only that it may be included in man users, but it isn't in freeradius2) I tried both: radiuscheck / radiusreply / radiuscheck and radius reply together. Nothing worked for me. That Is the reason why I'm almost sure that this isn't the cause of my problem.
Thank you for the information that attribute which I'd like to check in LDAP and send it to the NAS is reply item in ldap.attrmap. Is there anything else then ldap.attrmap that should be set up for sending vendor specific attributes from LDAP? Thank you Jakub Pech
On Fri, Nov 25, 2011 at 4:15 PM, Jakub Pech <jakub.pech@spinoco.com> wrote:
Is there anything else then ldap.attrmap that should be set up for sending vendor specific attributes from LDAP?
Let's try something basic. Were you able to see the attribute (and its value) when you do ldap query for that user (e.g. with ldapsearch)? -- Fajar
Dne 25.11.11 10:23, Fajar A. Nugraha napsal(a):
Is there anything else then ldap.attrmap that should be set up for sending
vendor specific attributes from LDAP? Let's try something basic. Were you able to see the attribute (and its value) when you do ldap query for that user (e.g. with ldapsearch)? Yes I'm.
On Fri, Nov 25, 2011 at 5:14 PM, Jakub Pech <jakub.pech@spinoco.com> wrote:
Dne 25.11.11 10:23, Fajar A. Nugraha napsal(a):
Is there anything else then ldap.attrmap that should be set up for sending
vendor specific attributes from LDAP?
Let's try something basic. Were you able to see the attribute (and its value) when you do ldap query for that user (e.g. with ldapsearch)?
Yes I'm.
Are you SURE? If ldapsearch (or whatever ldap client you use) can show radiusJuniperLocalUserName attribute correctly when you search for that user, then your /etc/raddb/ldap.attrmap entry should be enough (if you only have it as replyItem, that is). And to be safe, use tabs (like the original entries) instead of space. ... and Alan is right (as usual), your debug log hasn't shown any "ldap" lines in authorize phase. Probably you haven't uncomment it :) Now if you HAVE ldap activated in authorize section, I'd also take a look at this line ++[unix] returns updated That's wrong. You ONLY want to authenticate against LDAP, right? Comment out "unix" line from authorize section. -- Fajar
Dne 25.11.11 13:14, Fajar A. Nugraha napsal(a):
... and Alan is right (as usual), your debug log hasn't shown any "ldap" lines in authorize phase. Probably you haven't uncomment it :)
Now if you HAVE ldap activated in authorize section, I'd also take a look at this line
++[unix] returns updated
That's wrong. You ONLY want to authenticate against LDAP, right? Comment out "unix" line from authorize section.
I have already fixed it. After I red the authorize section in /sites-available/default I noticed that I was authorizing against linux users (that are authorized against the same LDAP). Thank you Fajar Jakub
Jakub Pech wrote:
First I undrestanded that the radius check are items that radius checks in LDAP. But since I havent found any documentation to ldap.attrmap file
Nonsense. The file contains comments which describe what it does. The doc/rlm_ldap file contains additional documentation.
(i found only that it may be included in man users, but it isn't in freeradius2) I tried both: radiuscheck / radiusreply / radiuscheck and radius reply together. Nothing worked for me. That Is the reason why I'm almost sure that this isn't the cause of my problem.
You're trying random things because you don't understand how it works. Even worse, you don't understand how RADIUS and LDAP works. Asking if FreeRADIUS reads the LDAP schema is *very* wrong. FreeRADIUS isn't an LDAP server.
Is there anything else then ldap.attrmap that should be set up for sending vendor specific attributes from LDAP?
The schema. Define an LDAP attribute which contains the information for the VSA. Map that attribute to RADIUS in ldap.attrmap. It should take all of 15 minutes. Alan DeKok.
Dne 25.11.11 10:34, Alan DeKok napsal(a):
Jakub Pech wrote:
First I undrestanded that the radius check are items that radius checks in LDAP. But since I havent found any documentation to ldap.attrmap file Nonsense. The file contains comments which describe what it does. The doc/rlm_ldap file contains additional documentation. I red mentioned comments/documents MANY times and I didn't noticed anything that will describe de difference between check/reply item.
(i found only that it may be included in man users, but it isn't in freeradius2) I tried both: radiuscheck / radiusreply / radiuscheck and radius reply together. Nothing worked for me. That Is the reason why I'm almost sure that this isn't the cause of my problem. You're trying random things because you don't understand how it works. Yes You are right. And because of it I'm reading the documentations, wiki, descriptions, I'm googling etc. Just normal things when I'm setting up something I haven't set up before. But I didn't find the solution on almost week of working so I'm asking.
Even worse, you don't understand how RADIUS and LDAP works. Asking if FreeRADIUS reads the LDAP schema is*very* wrong. FreeRADIUS isn't an LDAP server.
Is there anything else then ldap.attrmap that should be set up for sending vendor specific attributes from LDAP? The schema. Define an LDAP attribute which contains the information for the VSA. Map that attribute to RADIUS in ldap.attrmap. It should take all of 15 minutes. Ok, you didn't catch my question. Is there anything else then ldap.attrmap and /modules/ldap that should be set up on freeradius server? Of course I have LDAP schema updated on LDAP server.
Jakub Pech wrote:
I red mentioned comments/documents MANY times and I didn't noticed anything that will describe de difference between check/reply item.
The entire server is build around the concept of check and reply items. They work the same everywhere, in every module. Perhaps every configuration file should say "this is for FreeRADIUS, which is a RADIUS server, which does RADIUS authentication" ?
Yes You are right. And because of it I'm reading the documentations, wiki, descriptions, I'm googling etc. Just normal things when I'm setting up something I haven't set up before. But I didn't find the solution on almost week of working so I'm asking.
As I said, it should take 15 minutes. If you spent a week looking at random files instead of asking questions, all you've done is confuse yourself.
Ok, you didn't catch my question. Is there anything else then ldap.attrmap and /modules/ldap that should be set up on freeradius server? Of course I have LDAP schema updated on LDAP server.
Read raddb/sites-available/default. Look for "ldap" Alan DeKok.
Dne 25.11.11 12:27, Alan DeKok napsal(a):
Read raddb/sites-available/default. Look for "ldap"
:-) Thank you very very much Alan. This one # I've been searching from monday. If you will be in Prague in Czech republic send me an email. I owe you some beers.... Have a nice weekend Jakub
Hi,
If you will be in Prague in Czech republic send me an email. I owe you some beers....
...just wondering why these free beer offers seem to always be a few months after peope actually WERE in town .... ;-) alan
In documentation of freeradius 1.x I found that I have to import RADIUS-LDAPv3.schema to OpenLDAP. If I understand right radius server need to know the LDAP structure to be able to get values from defined attributes. But in freeradius 2.x there is no RADIUS-LDAPv3.schema and I did not find any other schema file where I should add my LDAP attributes. Do I have to import my OpenLDAP schema to freeradius to be able to get Vendor Specific Attributes from it? Jakub Dne 24.11.11 13:08, Alan DeKok napsal(a):
Well... where did you define it?
Jakub Pech wrote:
But in freeradius 2.x there is no RADIUS-LDAPv3.schema and I did not find any other schema file where I should add my LDAP attributes.
See doc/examples/
Do I have to import my OpenLDAP schema to freeradius to be able to get Vendor Specific Attributes from it?
You'll need to edit the schema for VSAs. Alan DeKok.
Alan DeKok napsal(a):
See doc/examples/ I've edited openldap.schema and add new attributetype + add new attribute to radiusprofile class. This schema I applied also to my OpenLDAP server. Does freeradius get the LDAP schema from docs/examples/openldap.schema file? The path docs/examples is confusing me. You'll need to edit the schema for VSAs. The schema have been edited but there is no change in behaviour. Do I have to import edited schema to freeradius somehow?
Thanks Jakub Pech
Hi,
See doc/examples/ I've edited openldap.schema and add new attributetype + add new attribute to radiusprofile class. This schema I applied also to my OpenLDAP server. Does freeradius get the LDAP schema from docs/examples/openldap.schema file? The path docs/examples is confusing me.
no. it doesnt. docs/ is just a documentation folder...and examples are just examples within! the server reads the configurations from its usual path if you read the docs, the wiki and the config files, you will see that in modules/ldap the following is listed dictionary_mapping = ${confdir}/ldap.attrmap so, just edit ldap.attrmap in the raddb config directory - and use the schema file to update your LDAP this document might help you further http://freeradius.org/radiusd/doc/ldap_howto.txt alan
participants (4)
-
Alan Buxey -
Alan DeKok -
Fajar A. Nugraha -
Jakub Pech