RE: LDAP basedn context
-----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Dustin Doris Sent: Tuesday, June 14, 2005 12:51 PM To: FreeRadius users mailing list Subject: Re:LDAP basedn context
Correct, it is unable to find the user. When set at a higher context I receive the following error:
rlm_ldap: performing search in o=wheaton, with filter (cn=testacct) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed
My ldap config is as follows. If I change the basedn to where the user is located (ou=cs,ou=srvc,o=wheaton) then it works.
ldap test-ldap{ server = "ldapserver.wheaton.edu" identity = "cn=admin,o=wheaton" password = password basedn = "o=wheaton" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes
tls_cacertfile = /etc/raddb/certs/wheatonCA/wheatonca.b64 tls_require_cert = "demand"
access_attr = "cn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword timeout = 4 timelimit = 3 net_timeout = 1 }
matt...
Is it possible to specify the basedn above where the users are actually located and have freeradius find the user in a subcontext? For instance if my ldap is setup as ou=users1,ou=loc1,o=org and ou=users2,ou=loc2,ou=o=org can I specify basedn="o=org" and find users in both users1 and users2?
Hmmm, I thought it did a subtree search, maybe not. You could use configurable_failover to search both trees.
FWIW, I am taking advantage of subtree search and it works fine. I don't see anything in his setup that would prevent it from happening.
in radiusd.conf make two ldap instances with the same config except the basedn.
ldap ldap1 { config with one basedn }
ldap ldap2 { config with other basedn }
in authorize section define them as a group
authorize { group { ldap1 ldap2 } }
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Correct, it is unable to find the user. When set at a higher context I receive the following error:
rlm_ldap: performing search in o=wheaton, with filter (cn=testacct) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed
My ldap config is as follows. If I change the basedn to where the user is located (ou=cs,ou=srvc,o=wheaton) then it works.
ldap test-ldap{ server = "ldapserver.wheaton.edu" identity = "cn=admin,o=wheaton" password = password basedn = "o=wheaton" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes
tls_cacertfile = /etc/raddb/certs/wheatonCA/wheatonca.b64 tls_require_cert = "demand"
access_attr = "cn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword timeout = 4 timelimit = 3 net_timeout = 1 }
matt...
Is it possible to specify the basedn above where the users are actually located and have freeradius find the user in a subcontext? For instance if my ldap is setup as ou=users1,ou=loc1,o=org and ou=users2,ou=loc2,ou=o=org can I specify basedn="o=org" and find users in both users1 and users2?
Hmmm, I thought it did a subtree search, maybe not. You could use configurable_failover to search both trees.
FWIW, I am taking advantage of subtree search and it works fine. I don't see anything in his setup that would prevent it from happening.
I thought you could do subtree. Matt, Although that looks like an admin type of user (perhaps even rootdn). If not, does the user you are binding with have proper permissions to do subtree searches? What does your ACL on the ldap server look like? What does a search from the command line give you? $ ldapsearch -D "cn=admin,o=wheaton" -w password -b o=wheaton "(cn=testacct)"
participants (2)
-
Dustin Doris -
Zawacki Jason D Contr AFRL/IFOS