Google LDAP Authentication for WIFI Setup issues

7 Nov 2024

      Hello,
I have been working on this for several days and am tired of asking an AI
for help. I have freeRadius installed on a RPI4 through apt, so its a 3.0
version.

First I tried following google workspace instructions, it connects and
looks up users fine, but it keeps trying to verify passwords in clear
texts...no good.

Next I noticed there is a mod named ldap_google in the mods-available,
which says it will bind users and void the clear text issue. I configured
that to connect to my workspace, fairly simple.

Next I moved that file to the enabled mods folder as well as moving the
google-ldap-auth file to the sites-enable folder. (I say move, I did a
symbolic link). After lots of troubleshooting, I removed the default from
the sites-enabled just to try and simplify everything.
First I ran into issues with the filter_inner_identity, I don't quite
understand why that is failing, but I saw somewhere else that is not
needed, so I commented it out. Now I keep seeing this:

(0) Received Access-Request Id 26 from 192.168.52.1:59099 to
192.168.52.155:1812 length 249
(0)   User-Name = "test@test.com"
(0)   NAS-IP-Address = 192.168.1.89
(0)   Called-Station-Id = "9A-7F-54-27-FD-35:***WIFI SSID****"
(0)   NAS-Port-Type = Wireless-802.11
(0)   Service-Type = Framed-User
(0)   Calling-Station-Id = "BE-35-1A-04-D3-70"
(0)   Connect-Info = "CONNECT 24Mbps 802.11a"
(0)   Acct-Session-Id = "C349A45BB76F8134"
(0)   Acct-Multi-Session-Id = "9A4E5DCFE2DA284C"
(0)   WLAN-Pairwise-Cipher = 1027076
(0)   WLAN-Group-Cipher = 1027076
(0)   WLAN-AKM-Suite = 1027077
(0)   WLAN-Group-Mgmt-Cipher = 1027078
(0)   Framed-MTU = 1400
(0)   EAP-Message = 0x027b0012017465737440746573742e636f6d
(0)   Message-Authenticator = 0xf88e64c655b98a2aa22e62a2844fe21d
(0) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/google-ldap-auth
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   ->
FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     policy split_username_nai {
(0)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(0)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(0)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(0)         update request {
(0)           EXPAND %{1}
(0)              --> test
(0)           &Stripped-User-Name := test
(0)         } # update request = noop
(0)         if ("%{3}" != '') {
(0)         EXPAND %{3}
(0)            --> test.com
(0)         if ("%{3}" != '')  -> TRUE
(0)         if ("%{3}" != '')  {
(0)           update request {
(0)             EXPAND %{3}
(0)                --> test.com
(0)             &Stripped-User-Domain = test.com
(0)           } # update request = noop
(0)         } # if ("%{3}" != '')  = noop
(0)         [updated] = updated
(0)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(0)       ... skipping else: Preceding "if" was taken
(0)     } # policy split_username_nai = updated
(0)     update control {
(0)       &Cache-Status-Only := yes
(0)     } # update control = noop
(0) cache_auth_accept: EXPAND
%{md5:%{%{Stripped-User-Name}:-%{User-Name}}%{User-Password}}
(0) cache_auth_accept:    --> 098f6bcd4621d373cade4e832627b4f6
(0) cache_auth_accept: No cache entry found for
"098f6bcd4621d373cade4e832627b4f6"
(0)     [cache_auth_accept] = notfound
(0)     if (ok) {
(0)     if (ok)  -> FALSE
(0)     update control {
(0)       &Cache-Status-Only := yes
(0)     } # update control = noop
(0) cache_auth_reject: EXPAND
%{md5:%{Calling-Station-Id}%{Stripped-User-Name}%{User-Password}}
(0) cache_auth_reject:    --> c12fe59cbee87c80dea47e15189a1410
(0) cache_auth_reject: No cache entry found for
"c12fe59cbee87c80dea47e15189a1410"
(0)     [cache_auth_reject] = notfound
(0)     if (ok) {
(0)     if (ok)  -> FALSE
(0)     if (&User-Password && !control:Auth-Type)  {
(0)     if (&User-Password && !control:Auth-Type)   -> FALSE
(0)   } # authorize = updated
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type =
Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file
/etc/freeradius/3.0/sites-enabled/google-ldap-auth
(0)   Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> test@test.com
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     if (&control:Auth-Type == ldap) {
(0)     ERROR: Failed retrieving values required to evaluate condition
(0)     update control {
(0)       &Cache-TTL := 0
(0)     } # update control = noop
(0) cache_ldap_user_dn: EXPAND %{Stripped-User-Name}
(0) cache_ldap_user_dn:    --> test
(0) cache_ldap_user_dn: No cache entry found for "test"
(0) cache_ldap_user_dn: Creating new cache entry
(0) cache_ldap_user_dn: Merging cache entry into request
(0) cache_ldap_user_dn: Committed entry, TTL 86400 seconds
(0)     [cache_ldap_user_dn] = updated
(0)   } # Post-Auth-Type REJECT = updated
(0) Login incorrect (No Auth-Type found: rejecting the user via
Post-Auth-Type = Reject): [test@test.com/<no User-Password attribute>]
(from client 192.168.52.1 port 0 cli BE-35-1A-04-D3-70)
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 26 from 192.168.52.155:1812 to 192.168.52.1:59099
length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 26 with timestamp +19 due to
cleanup_delay was reached

There is an IF condition in the site config to check for the User-Password
before it sets the Auth-Type, however it appears there is no user password,
so the condition fails and it never even attempts to connect to LDAP.

So the big question, is why is there no password? I am testing with my
iPad, and I am typing in a password when connecting to the Wifi. The wifi
config is set to WPA Enterprise.

Thanks in advance for any help

Joseph Allen

Matthew Newton

Joseph Allen

Alan DeKok

Joseph Allen

Wessel Louwris

Alan DeKok

tags

participants (4)