Hi friends!! In the company where I work, we have a wireless controller which is authenitcating with a LDAP server using this configuration: IP address: 192.168.0.10 LDAP Base DN = "plataform.example.com.co" Admin DN= "cn=roam,dc=example,dc=com,dc=co" Admin password = 12345 Key attribute = uid SearchFilter= "userType=managment" With that configuration the people from managment department can login in the wireless network. I can change to SearchFilter= "userType=guest", so the people from managment department can not login, but guest people can do it. No we need to use a FreeRadius server to set a new wireless controller that can't use LDAP authentication. So, I installed freeradius-ldap package, and I enabled the module. This is my ldap file: ldap { server = "plataform.example.com.co" identity = "cn=roam,dc=example,dc=com,dc=co" password = 12345 basedn = "dc=example,dc=com,dc=co" ldap_connections_number = 5 ... } I enabled LDAP module, and reloaded the freeradius configuration and every works great :D I can autheniticate using freeradius and Ldap server. But the issue is: with that setting people from managment department and guest people can logging in the wireless network, both of them. That is a problem for me, I need to apply the same Filter that the previous wirless controller had enabled ( Key attribute = uid and SearchFilter= "userType=managment") I have tried using these attibutes in ldap config file: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" I have tried many combinations but I cant' do it work. Can you give me any advice about how can I configure the freeradius-ldap module in order to do that filter? Thanks in advance!!! Andrés!!
But the issue is: with that setting people from managment department and guest people can logging in the wireless network, both of them. That is a problem for me, I need to apply the same Filter that the previous wirless controller had enabled ( Key attribute = uid and SearchFilter= "userType=managment") I have tried using these attibutes in ldap config file: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)"
I have tried many combinations but I cant' do it work.
1) Upgrade to a supported version of FreeRADIUS i.e. 3.0.15 2) If you still experience the same issue, post the output of radiusd -X. -Arran
On Sep 16, 2017, at 8:51 PM, Andrés Gómez <andres.gomez.ruiz@gmail.com> wrote:
I have tried many combinations but I cant' do it work.
See the FAQ for "it doesn't work".
Can you give me any advice about how can I configure the freeradius-ldap module in order to do that filter?
You told us what you did. You didn't tell us what happened. You *can* post the debug log as suggested in the FAQ, "man" page, web pages, and all the time on this list. Saying "it doesn't work" is entirely unhelpful. And doesn't let us help you. Alan DeKok.
Hi Arran, I'm using Freeradius 2.2.8, It's not easy to upgrade to 3.x, I will try if definitly I cant solve it. Alan, sorry, let me explain better. This is an example of the user "pares" who is part of the "userType: managment": ldapsearch -x -LLL -h platform.example.com.co -D "cn=comroam,dc=example,dc=com,dc=co" -w BI3AixvSQt8hjjKc34CI -b"uid=pares,ou=invit,dc=example,dc=com,dc=co" dn: uid=pares,ou=invitados,dc=example,dc=com,dc=co objectClass: top objectClass: person objectClass: organizationalPerson objectClass: qmailUser cn: Pares sn:: QWNhZMOpbWljb3M= state:: U29saWNpdGFkbyBwb3IgVmljZXJyZWN0b3LDrWE= *userType: managment*uid: pares And this is an example of the user "utposgr" who is part of the "userType: guest" ldapsearch -x -LLL -h platform.example.com.co -D "cn=comroam,dc=example,dc=com,dc=co" -w BI3AixvSQt8hjjKc34CI -b"uid=utposgr,ou=invit,dc=example,dc=com,dc=co" dn: uid=utposgr,ou=invitados,dc=example,dc=com,dc=co uid: utposgr *userType: guest* state: solicit sn: CGR cn: Invitado objectClass: top objectClass: person objectClass: organizationalPerson objectClass: qmailUser As I said, I need to configure a Freeradius able to use a LDAP module and filter to let autenticate only the user who has "userType: managment" objetc in LDAP directory. So, I set the freeradius.ldap module like this: ldap { server = "plataform.example.com.co" identity = "cn=roam,dc=example,dc=com,dc=co" password = 12345 basedn = "dc=example,dc=com,dc=co" ldap_connections_number = 5 ... } Results: I can authenticate Both users (pares and utposgr). Now I need to apply the filter of the objetc, so I tried this; ldap { server = "plataform.example.com.co" identity = "cn=roam,dc=example,dc=com,dc=co" password = 12345 basedn = "dc=example,dc=com,dc=co" base_filter = "(*userType= managment*)" ldap_connections_number = 5 ... } After reload, I still can authenticathe Both users (pares and utposgr), but What I need is to only authenticate user "pares" because user "utposgr" has a different LDAP object (*userType: guest*). This is the debug output when I tried to authenticate the user utposgr (supposed to be rejected): Cleaning up request 2 ID 79 with timestamp +319 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38585, id=15, length=81 User-Name = "utposgr" User-Password = "ut2014" NAS-IP-Address = 192.168.70.90 NAS-Port = 1812 Message-Authenticator = 0xbc046700e4bb678a5b8bd88f9d3c9e42 # Executing section authorize from file /etc/freeradius/sites-enabled/ default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "utposgr", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [ldap] performing user authorization for utposgr [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> utposgr [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=utposgr) [ldap] expand: dc=example,dc=com,dc=co -> dc=example,dc=com,dc=co [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com,dc=co, with filter (uid=utposgr) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = LDAP # Executing group from file /etc/freeradius/sites-enabled/default +group LDAP { [ldap] login attempt by "utposgr" with password "ut2014" [ldap] user DN: uid=utposgr,ou=invit,dc=example,dc=com,dc=co [ldap] (re)connect to plataform.example.com.co:389, authentication 1 [ldap] bind as uid=utposgr,ou=invit,dc=example,dc=com,dc=co/ut2014 to plataform.example.com.co:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] *user utposgr authenticated succesfully* ++[ldap] = ok +} # group LDAP = ok Login OK: [utposgr/ut2014] (from client localhost port 1812) # Executing section post-auth from file /etc/freeradius/sites-enabled/ default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 15 to 127.0.0.1 port 38585 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 15 with timestamp +326 Ready to process requests. I also tried ldap { server = "plataform.example.com.co" identity = "cn=roam,dc=example,dc=com,dc=co" password = 12345 basedn = "dc=example,dc=com,dc=co" * filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"* * base_filter = "(userType= managment*)" ldap_connections_number = 5 ... } But the same results, I dont know how to make the filter of the LDAP object "userType= managment" and the user who has the "userType= guest" can authenticate. Thanks in advance!!! 2017-09-17 7:22 GMT-05:00 Alan DeKok <aland@deployingradius.com>:
On Sep 16, 2017, at 8:51 PM, Andrés Gómez <andres.gomez.ruiz@gmail.com> wrote:
I have tried many combinations but I cant' do it work.
See the FAQ for "it doesn't work".
Can you give me any advice about how can I configure the freeradius-ldap module in order to do that filter?
You told us what you did. You didn't tell us what happened. You *can* post the debug log as suggested in the FAQ, "man" page, web pages, and all the time on this list.
Saying "it doesn't work" is entirely unhelpful. And doesn't let us help you.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- *C. Andrés Gómez R.* *Magister en Software Libre*
On 18 September 2017 03:49:43 BST, "Andrés Gómez" <andres.gomez.ruiz@gmail.com> wrote:
I also tried ldap {
server = "plataform.example.com.co" identity = "cn=roam,dc=example,dc=com,dc=co" password = 12345 basedn = "dc=example,dc=com,dc=co" * filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"* * base_filter = "(userType= managment*)" ldap_connections_number = 5 ... }
But the same results, I dont know how to make the filter of the LDAP object "userType= managment" and the user who has the "userType= guest" can authenticate.
Combine both in the one filter? filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(userType=managment))" But still, v2 is unsupported and you really should look to upgrade to v3.0.15. -- Matthew
Hi Matthew This Filter worked great!! filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})( userType=managment))" Thanks a lot!!! Andrés 2017-09-18 1:59 GMT-05:00 Matthew Newton <mcn@freeradius.org>:
On 18 September 2017 03:49:43 BST, "Andrés Gómez" < andres.gomez.ruiz@gmail.com> wrote:
I also tried ldap {
server = "plataform.example.com.co" identity = "cn=roam,dc=example,dc=com,dc=co" password = 12345 basedn = "dc=example,dc=com,dc=co" * filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"* * base_filter = "(userType= managment*)" ldap_connections_number = 5 ... }
But the same results, I dont know how to make the filter of the LDAP object "userType= managment" and the user who has the "userType= guest" can authenticate.
Combine both in the one filter?
filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})( userType=managment))"
But still, v2 is unsupported and you really should look to upgrade to v3.0.15.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (4)
-
Alan DeKok -
Andrés Gómez -
Arran Cudbard-Bell -
Matthew Newton