Hello, I'm using freeRaduis version 2.1.12+dfsg-1.2. I'm trying to get some parameters from an AD server but I have problems with the search filter. Here is my ldap configuration: ldap { server = "myldapserver" basedn = "dc=ad,dc=domain,dc=fr" identity = "cn=LinOTP-Auth,ou=AD-Man,ou=Ressources,dc=ad,dc=domain,dc=fr" filter = "sAMAccountName==%{User-Name}" #base_filter = "(objectclass=sAMAccountName)" start_tls = no groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" #profile_attribute = "radiusFramedIPAddress" profile_attribute = "radiusprofile" access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 4 timelimit = 5 net_timeout = 1 set_auth_type = yes } I'm not sure about the filter parameter. Here are freeradius logs: [ldap] performing user authorization for hatim [ldap] expand: sAMAccountName==%{User-Name} -> sAMAccountName==hatim [ldap] expand: dc=ad,dc=domain,dc=fr -> dc=ad,dc=domain,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to myldapserver:389, authentication 0 [ldap] bind as cn=LinOTP-Auth,ou=AD-Man,ou=Ressources,dc=ad,dc=domain,dc=fr/ to myldapserver:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ad,dc=domain,dc=fr, with filter sAMAccountName==hatim [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Can you help me please? Thank you!
You shouldn't have two = in the search filter. filter = "(sAMAccountName=%{User-Name})" Or take the original one and replace the search value: filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" On Thu, Jul 2, 2015 at 9:31 PM, Hatim CHIKHI <hatim.networking@gmail.com> wrote:
Hello,
I'm using freeRaduis version 2.1.12+dfsg-1.2.
I'm trying to get some parameters from an AD server but I have problems with the search filter.
Here is my ldap configuration:
ldap {
server = "myldapserver"
basedn = "dc=ad,dc=domain,dc=fr"
identity = "cn=LinOTP-Auth,ou=AD-Man,ou=Ressources,dc=ad,dc=domain,dc=fr"
filter = "sAMAccountName==%{User-Name}"
#base_filter = "(objectclass=sAMAccountName)"
start_tls = no
groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
#profile_attribute = "radiusFramedIPAddress"
profile_attribute = "radiusprofile"
access_attr = "uid"
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 10
timeout = 4
timelimit = 5
net_timeout = 1
set_auth_type = yes
}
I'm not sure about the filter parameter.
Here are freeradius logs:
[ldap] performing user authorization for hatim
[ldap] expand: sAMAccountName==%{User-Name} -> sAMAccountName==hatim
[ldap] expand: dc=ad,dc=domain,dc=fr -> dc=ad,dc=domain,dc=fr
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] attempting LDAP reconnection
[ldap] (re)connect to myldapserver:389, authentication 0
[ldap] bind as cn=LinOTP-Auth,ou=AD-Man,ou=Ressources,dc=ad,dc=domain,dc=fr/ to myldapserver:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] performing search in dc=ad,dc=domain,dc=fr, with filter sAMAccountName==hatim
[ldap] ldap_search() failed: Operations error
[ldap] search failed
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns fail
Can you help me please?
Thank you! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 2, 2015, at 5:31 AM, Hatim CHIKHI <hatim.networking@gmail.com> wrote:
I'm using freeRaduis version 2.1.12+dfsg-1.2.
You should upgrade.
I'm trying to get some parameters from an AD server but I have problems with the search filter. ... [ldap] ldap_search() failed: Operations error
This is fixed (and documented) in later versions of the server. Install 2.2.7. Alan DeKok.
Thanks guys for your reply. I upgraded to freeradius 2.2.7 but I still have the same problem. If it is not a version issue, what whould be the cause of the problem? 2015-07-02 13:07 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Jul 2, 2015, at 5:31 AM, Hatim CHIKHI <hatim.networking@gmail.com> wrote:
I'm using freeRaduis version 2.1.12+dfsg-1.2.
You should upgrade.
I'm trying to get some parameters from an AD server but I have problems with the search filter. ... [ldap] ldap_search() failed: Operations error
This is fixed (and documented) in later versions of the server. Install 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Now, when I add password = "****" to the ldap config I get this error instead: [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ad,dc=domain,dc=fr, with filter sAMAccountName=hatim [ldap] ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = fail I increased the timeout but in vain!! 2015-07-02 17:29 GMT+02:00 Hatim CHIKHI <hatim.networking@gmail.com>:
Thanks guys for your reply.
I upgraded to freeradius 2.2.7 but I still have the same problem.
If it is not a version issue, what whould be the cause of the problem?
2015-07-02 13:07 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Jul 2, 2015, at 5:31 AM, Hatim CHIKHI <hatim.networking@gmail.com> wrote:
I'm using freeRaduis version 2.1.12+dfsg-1.2.
You should upgrade.
I'm trying to get some parameters from an AD server but I have problems with the search filter. ... [ldap] ldap_search() failed: Operations error
This is fixed (and documented) in later versions of the server. Install 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 2 Jul 2015, at 11:46, Hatim CHIKHI <hatim.networking@gmail.com> wrote:
Now, when I add password = "****" to the ldap config I get this error instead:
[ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ad,dc=domain,dc=fr, with filter sAMAccountName=hatim [ldap] ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = fail
Likely hopping around the AD forrest and timing out. Use ldapsearch to repeat the search and check the results. If it times out as well then that's your issue. Fix AD. If not, then compare the wireshark captures to see what's different between the two searches. If you think rlm_ldap is doing something wrong, upgrade to v3.0.8, and state what you think it should do different. -Arran
I increased the timeout but in vain!!
2015-07-02 17:29 GMT+02:00 Hatim CHIKHI <hatim.networking@gmail.com>:
Thanks guys for your reply.
I upgraded to freeradius 2.2.7 but I still have the same problem.
If it is not a version issue, what whould be the cause of the problem?
2015-07-02 13:07 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Jul 2, 2015, at 5:31 AM, Hatim CHIKHI <hatim.networking@gmail.com> wrote:
I'm using freeRaduis version 2.1.12+dfsg-1.2.
You should upgrade.
I'm trying to get some parameters from an AD server but I have problems with the search filter. ... [ldap] ldap_search() failed: Operations error
This is fixed (and documented) in later versions of the server. Install 2.2.7.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Hatim CHIKHI -
Peter Lambrechtsen