Hi I try to connect my Freeradius to a Zimbra LDAP server with multidomain. In Zimbra, the LDAP tree is something like : "ou=people,dc=domain,dc=tld". I have some domains in ".fr" and some other in ".org". If I configure with the basedn = "dc=fr", Freeradius works well for all the domains in ".fr". But if I try to allow all my domains (with a basedn=""), Freeradius don't accept to authenticate the users. In the logs, when there is a reject, I can see : [ldap-inner-tunnel] performing user authorization for XXXXX [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] unable to create basedn. ++[ldap-inner-tunnel] returns invalid Invalid user: [XXXXX.fr] (from client localhost port 0 via TLS tunnel) I found a topic in the list http://freeradius.1045715.n5.nabble.com/Sending-null-BaseDN-td5716006.html in 2012, but there is no solution. I am on a Debian stable Freeradius 2.1.12 Thanks a lot. Dom
Dominique Fournier wrote:
In the logs, when there is a reject, I can see : [ldap-inner-tunnel] performing user authorization for XXXXX [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] unable to create basedn.
Try creating the basedn which contains only a space. That might work. The LDAP module is generally intended to search within a particular base DN. It can be a security risk to allow searching of the entire tree. Or, you can configure two LDAP modules. One to search in .fr, and the other to search in .org. Alan DeKok.
On 29 Nov 2013, at 15:57, Alan DeKok <aland@deployingradius.com> wrote:
Dominique Fournier wrote:
In the logs, when there is a reject, I can see : [ldap-inner-tunnel] performing user authorization for XXXXX [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] unable to create basedn.
Try creating the basedn which contains only a space. That might work.
The LDAP module is generally intended to search within a particular base DN. It can be a security risk to allow searching of the entire tree.
Only if you're incompetent and setup the ACLs incorrectly. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 29 Nov 2013, at 15:39, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
I try to connect my Freeradius to a Zimbra LDAP server with multidomain. In Zimbra, the LDAP tree is something like : "ou=people,dc=domain,dc=tld".
I have some domains in ".fr" and some other in ".org".
If I configure with the basedn = "dc=fr", Freeradius works well for all the domains in ".fr". But if I try to allow all my domains (with a basedn=""), Freeradius don't accept to authenticate the users.
In the logs, when there is a reject, I can see : [ldap-inner-tunnel] performing user authorization for XXXXX [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] unable to create basedn. ++[ldap-inner-tunnel] returns invalid Invalid user: [XXXXX.fr] (from client localhost port 0 via TLS tunnel)
I found a topic in the list http://freeradius.1045715.n5.nabble.com/Sending-null-BaseDN-td5716006.html in 2012, but there is no solution.
I am on a Debian stable Freeradius 2.1.12
It was precisely for this reason that in version 3 there was a distinction made between the failure case of xlats, and the case where the expansion was a zero length string. It should work fine in 3.0.0 3.0.x or master, there is no solution for that version unless you can insert some chars into the base_dn that the LDAP server will ignore. You could try a bit of whitespace? -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Hi I just try with a space in it and it doesn't work. I have the logs : [ldap-inner-tunnel] performing user authorization for richard.heral [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] ldap_get_conn: Checking Id: 0 [ldap-inner-tunnel] ldap_get_conn: Got Id: 0 [ldap-inner-tunnel] attempting LDAP reconnection [ldap-inner-tunnel] (re)connect to ldaps://XXXXXfr:636, authentication 0 [ldap-inner-tunnel] bind as uid=XXXXX=fr/YYYY to ldaps://XXXXX.fr:636 [ldap-inner-tunnel] waiting for bind result ... [ldap-inner-tunnel] Bind was successful [ldap-inner-tunnel] performing search in , with filter (mail=XXXX.fr) [ldap-inner-tunnel] ldap_search() failed: Invalid DN syntax [ldap-inner-tunnel] search failed [ldap-inner-tunnel] ldap_release_conn: Release Id: 0 ++[ldap-inner-tunnel] returns fail So there is no solution for me... except go to freeradius 3. Do you think a patch can be processed to the 2.x branch without changing everything ? Thanks a lot Dom Thanks for your ans Le 29/11/2013 16:58, Arran Cudbard-Bell a écrit :
On 29 Nov 2013, at 15:39, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
I try to connect my Freeradius to a Zimbra LDAP server with multidomain. In Zimbra, the LDAP tree is something like : "ou=people,dc=domain,dc=tld".
I have some domains in ".fr" and some other in ".org".
If I configure with the basedn = "dc=fr", Freeradius works well for all the domains in ".fr". But if I try to allow all my domains (with a basedn=""), Freeradius don't accept to authenticate the users.
In the logs, when there is a reject, I can see : [ldap-inner-tunnel] performing user authorization for XXXXX [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] unable to create basedn. ++[ldap-inner-tunnel] returns invalid Invalid user: [XXXXX.fr] (from client localhost port 0 via TLS tunnel)
I found a topic in the list http://freeradius.1045715.n5.nabble.com/Sending-null-BaseDN-td5716006.html in 2012, but there is no solution.
I am on a Debian stable Freeradius 2.1.12
It was precisely for this reason that in version 3 there was a distinction made between the failure case of xlats, and the case where the expansion was a zero length string.
It should work fine in 3.0.0 3.0.x or master, there is no solution for that version unless you can insert some chars into the base_dn that the LDAP server will ignore. You could try a bit of whitespace?
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 29 Nov 2013, at 17:31, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
I just try with a space in it and it doesn't work. I have the logs : [ldap-inner-tunnel] performing user authorization for richard.heral [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] ldap_get_conn: Checking Id: 0 [ldap-inner-tunnel] ldap_get_conn: Got Id: 0 [ldap-inner-tunnel] attempting LDAP reconnection [ldap-inner-tunnel] (re)connect to ldaps://XXXXXfr:636, authentication 0 [ldap-inner-tunnel] bind as uid=XXXXX=fr/YYYY to ldaps://XXXXX.fr:636 [ldap-inner-tunnel] waiting for bind result ... [ldap-inner-tunnel] Bind was successful [ldap-inner-tunnel] performing search in , with filter (mail=XXXX.fr) [ldap-inner-tunnel] ldap_search() failed: Invalid DN syntax [ldap-inner-tunnel] search failed [ldap-inner-tunnel] ldap_release_conn: Release Id: 0 ++[ldap-inner-tunnel] returns fail
So there is no solution for me... except go to freeradius 3.
Do you think a patch can be processed to the 2.x branch without changing everything ?
Sure. Can you make sure this actually fixes it though. I'm not sure how libldap will deal with zero length basedn strings. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 29 Nov 2013, at 21:28, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 29 Nov 2013, at 17:31, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
I just try with a space in it and it doesn't work. I have the logs : [ldap-inner-tunnel] performing user authorization for richard.heral [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] ldap_get_conn: Checking Id: 0 [ldap-inner-tunnel] ldap_get_conn: Got Id: 0 [ldap-inner-tunnel] attempting LDAP reconnection [ldap-inner-tunnel] (re)connect to ldaps://XXXXXfr:636, authentication 0 [ldap-inner-tunnel] bind as uid=XXXXX=fr/YYYY to ldaps://XXXXX.fr:636 [ldap-inner-tunnel] waiting for bind result ... [ldap-inner-tunnel] Bind was successful [ldap-inner-tunnel] performing search in , with filter (mail=XXXX.fr) [ldap-inner-tunnel] ldap_search() failed: Invalid DN syntax [ldap-inner-tunnel] search failed [ldap-inner-tunnel] ldap_release_conn: Release Id: 0 ++[ldap-inner-tunnel] returns fail
So there is no solution for me... except go to freeradius 3.
Do you think a patch can be processed to the 2.x branch without changing everything ?
Sure. Can you make sure this actually fixes it though. I'm not sure how libldap will deal with zero length basedn strings.
For it to work you actually need to comment out basedn in the config. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Hi All works very well !! Thanks a lot for your patch ! Do you integrate it in the trunk branch for 2.x ? Thanks again Dom On 29/11/13 22:29, Arran Cudbard-Bell wrote:
On 29 Nov 2013, at 21:28, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 29 Nov 2013, at 17:31, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
I just try with a space in it and it doesn't work. I have the logs : [ldap-inner-tunnel] performing user authorization for richard.heral [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] ldap_get_conn: Checking Id: 0 [ldap-inner-tunnel] ldap_get_conn: Got Id: 0 [ldap-inner-tunnel] attempting LDAP reconnection [ldap-inner-tunnel] (re)connect to ldaps://XXXXXfr:636, authentication 0 [ldap-inner-tunnel] bind as uid=XXXXX=fr/YYYY to ldaps://XXXXX.fr:636 [ldap-inner-tunnel] waiting for bind result ... [ldap-inner-tunnel] Bind was successful [ldap-inner-tunnel] performing search in , with filter (mail=XXXX.fr) [ldap-inner-tunnel] ldap_search() failed: Invalid DN syntax [ldap-inner-tunnel] search failed [ldap-inner-tunnel] ldap_release_conn: Release Id: 0 ++[ldap-inner-tunnel] returns fail
So there is no solution for me... except go to freeradius 3.
Do you think a patch can be processed to the 2.x branch without changing everything ?
Sure. Can you make sure this actually fixes it though. I'm not sure how libldap will deal with zero length basedn strings.
For it to work you actually need to comment out basedn in the config.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 2 Dec 2013, at 09:28, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
All works very well !! Thanks a lot for your patch !
Do you integrate it in the trunk branch for 2.x ?
Yes, just pushed it back to the v2.x.x branch. Guess I should fix up 3.0.x/master to have the same behaviour as well, it might complain if the basedn is not set. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
For debian, I send a bug report to integrate this feature in the packages. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731119 Thanks a lot! Le 02/12/2013 20:09, Arran Cudbard-Bell a écrit :
On 2 Dec 2013, at 09:28, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
All works very well !! Thanks a lot for your patch !
Do you integrate it in the trunk branch for 2.x ?
Yes, just pushed it back to the v2.x.x branch.
Guess I should fix up 3.0.x/master to have the same behaviour as well, it might complain if the basedn is not set.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks a lot Arran, I'll try this on monday. Good job ! Thanks Dom Le 29/11/2013 22:28, Arran Cudbard-Bell a écrit :
On 29 Nov 2013, at 17:31, Dominique Fournier <dominique.fournier@grenoble.cnrs.fr> wrote:
Hi
I just try with a space in it and it doesn't work. I have the logs : [ldap-inner-tunnel] performing user authorization for richard.heral [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] ldap_get_conn: Checking Id: 0 [ldap-inner-tunnel] ldap_get_conn: Got Id: 0 [ldap-inner-tunnel] attempting LDAP reconnection [ldap-inner-tunnel] (re)connect to ldaps://XXXXXfr:636, authentication 0 [ldap-inner-tunnel] bind as uid=XXXXX=fr/YYYY to ldaps://XXXXX.fr:636 [ldap-inner-tunnel] waiting for bind result ... [ldap-inner-tunnel] Bind was successful [ldap-inner-tunnel] performing search in , with filter (mail=XXXX.fr) [ldap-inner-tunnel] ldap_search() failed: Invalid DN syntax [ldap-inner-tunnel] search failed [ldap-inner-tunnel] ldap_release_conn: Release Id: 0 ++[ldap-inner-tunnel] returns fail
So there is no solution for me... except go to freeradius 3.
Do you think a patch can be processed to the 2.x branch without changing everything ?
Sure. Can you make sure this actually fixes it though. I'm not sure how libldap will deal with zero length basedn strings.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Dominique Fournier