Thank you Alan! That is what I assumed however I was told that this was the LDAP quering account but it must not be because than an a successful bind would occur. Thank you for your time I appreciate it! From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com@lists.freeradius.org> on behalf of freeradius-users-request@lists.freeradius.org <freeradius-users-request@lists.freeradius.org> Sent: Wednesday, August 22, 2018 3:00 AM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 160, Issue 45   Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius 3.0.17 EAP-TLS Authentication with LDAP Authorization (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 21 Aug 2018 18:09:19 -0400 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeradius 3.0.17 EAP-TLS Authentication with LDAP Authorization Message-ID: <FDDB0943-3129-4341-8965-7D98F5AAF5E4@deployingradius.com> Content-Type: text/plain; charset=us-ascii

On Aug 21, 2018, at 3:29 PM, Kevin Virk <Kevin.Virk@faithlife.com> wrote:

Hello all I have followed previous advice given to me and upgraded my install to FreeRADIUS 3.0.17 . I am trying to achieve a setup where computers are let onto company internet via eap-tls and then are separated into VLANS with ldap after this. Currently I believe I have eap-tls working as my eapol test has been successful. However after adding in the ldap module I am getting a bind error which I know is an LDAP error and not a freeradius one. I was hoping someone here could take a look at my debug info and see if I have overlooked anything.

The debug message should be clear:

... (6) ldap: Performing search in "dc=Domain,dc=net" with filter "(samaccountname=client.pem)", scope "sub" (6) ldap: Waiting for search result... (6) ldap: ERROR: Failed performing search: Operations error with LDAP database. Please see the LDAP server configuration / documentation for more information. (6) ldap: ERROR: Server said: 000004DC: LdapErr: DSID-0C0907C2, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580.

The LDAP database requires FreeRADIUS to do a bind before a search. That message should be clear. Fix the LDAP database so that it lets FreeRADIUS do searches. The LDAP module is configured as: ldap { server = "Domain.net" identity = "cn=ldap.query,ou=service.accounts,ou=Users,ou=operations,ou=departments,dc=Domain,dc=net" password = <<< secret >>> That user identity isn't allowed to do LDAP searches. So... fix the LDAP database so that user identity can do LDAP searches. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 160, Issue 45 *************************************************