2.1.10 Here's a snippet of freeradius -X... +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=Departments,dc=corp,dc=development,dc=com -> ou=Departments,dc=corp,dc=development,dc=com [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=RobertTest1)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(sAMAccountName=RobertTest1)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(cn=WANN)(|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop Sending Access-Accept of id 100 to 192.168.100.2 port 1645 User-Name = "DEVELOPMENT\\RobertTest1" MS-MPPE-Recv-Key = 0xa873077b6643bb983d8dbf04da66667699d7832fe38f78c5458b0318eaa27db6 MS-MPPE-Send-Key = 0x866779d60ae2e9da0a928ebfb1f20e2f5e26dc05d050075dc8e65210e2946936 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. This is in my postauth_users file... DEFAULT Huntgroup-Name == Switches, Ldap-Group == "WANN" Service-Type = "Framed-User", Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "dragons_cave" The 10th line from the bottom of the snippet returns with the following... rlm_ldap::ldap_groupcmp: ldap_get_values() failed I'm waiting for a subsequent "[ldap] performing search in" my DN and to match with filter (cn=WANN) But it's not happening. Any insight? Thx. Joe -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing-... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 04/07/2011 10:06 PM, joezamosc wrote:
2.1.10
Here's a snippet of freeradius -X...
+- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=Departments,dc=corp,dc=development,dc=com -> ou=Departments,dc=corp,dc=development,dc=com [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=RobertTest1)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(sAMAccountName=RobertTest1)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) ->
You are using Active Directory, and this LDAP filter is invalid. You want: (&(objectClass=group)(member=%{control:Ldap-UserDn}))
joezamosc <joezamosc@yahoo.com> wrote:
The 10th line from the bottom of the snippet returns with the following...
rlm_ldap::ldap_groupcmp: ldap_get_values() failed
I'm waiting for a subsequent "[ldap] performing search in" my DN and to match with filter (cn=WANN) But it's not happening.
It is happening, you have to read the debug ;) ---- [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(cn=WANN)(|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom)))) ----
Any insight?
You are hunting for the group under 'ou=Departments,dc=corp,dc=development,dc=com', effectively doing: ---- ldapsearch -h server -x -b ou=Departments,dc=corp,dc=development,dc=com '(&(cn=WANN)(|(&(objectClass=GroupOfNames)(member=CN...' ---- I'm guessing that's not where 'cn=WANN' lives? What does the following give you? ---- ldapsearch -h server -x -b dc=corp,dc=development,dc=com cn=wann dn member ---- Cheers -- Alexander Clouter .sigmonster says: Creditor, n.: A man who has a better memory than a debtor.
Phil - i changed according to your suggestion. Still getting the "rlm_ldap::ldap_groupcmp: ldap_get_values() failed" error. Alexander - you have a point - WANN is under OU - I've made an adjustment in modules/ldap and changed groupname_attribute to ou "groupname_attribute = ou" But after running it - i still receive "rlm_ldap::ldap_groupcmp: ldap_get_values() failed" error... +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=Departments,dc=corp,dc=development,dc=com -> ou=Departments,dc=corp,dc=development,dc=com [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=RobertTest1)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(sAMAccountName=RobertTest1)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (&(objectClass=group)(member=%{control:Ldap-UserDn})) -> (&(objectClass=group)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(ou=WANN)(&(objectClass=group)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop Sending Access-Accept of id 224 to 192.168.100.2 port 1645 User-Name = "DEVELOPMENT\\RobertTest1" MS-MPPE-Recv-Key = 0x8c2d74933e7870173463e1855e01e93bf9e67a837387801d85c5b9e307b0d08f MS-MPPE-Send-Key = 0x677459a0d6a7498398e7d7083e9ab49d33be9d812e6a3117569cdf126f9b385c EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. And after running ldapsearch -h server -x -b dc=corp,dc=development,dc=com ou=wann dn member I get... # extended LDIF # # LDAPv3 # base <DC=corp,DC=development,DC=com> with scope subtree # filter: ou=wann # requesting: ALL # # WANN, Departments, corp.development.com dn: OU=WANN,OU=Departments,DC=corp,DC=development,DC=com objectClass: top objectClass: organizationalUnit ou: WANN distinguishedName: OU=WANN,OU=Departments,DC=corp,DC=development,DC=com instanceType: 4 whenCreated: 20110405164142.0Z whenChanged: 20110405164142.0Z uSNCreated: 10913685 uSNChanged: 10913685 name: WANN objectGUID:: Eqi2LbFChke1MJ1VS9a4GA== objectCategory: CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=corp,DC=d evelopment,DC=com # search reference ref: ldap://ForestDnsZones.corp.development.com/DC=ForestDnsZones,DC=corp,DC=development,DC=com # search reference ref: ldap://DomainDnsZones.corp.development.com/DC=DomainDnsZones,DC=corp,DC=development,DC=com # search reference ref: ldap://corp.development.com/CN=Configuration,DC=corp,DC=development,DC=com # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 1 # numReferences: 3 -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing-... Sent from the FreeRadius - User mailing list archive at Nabble.com.
joezamosc <joezamosc@yahoo.com> wrote:
Alexander - you have a point - WANN is under OU - I've made an adjustment in modules/ldap and changed groupname_attribute to ou "groupname_attribute = ou"
'groupname_attribute' should be 'cn', unless your LDAP directory is very broken ;)
And after running ldapsearch -h server -x -b dc=corp,dc=development,dc=com ou=wann dn member I get...
# extended LDIF # # LDAPv3 # base <DC=corp,DC=development,DC=com> with scope subtree # filter: ou=wann # requesting: ALL #
# WANN, Departments, corp.development.com dn: OU=WANN,OU=Departments,DC=corp,DC=development,DC=com objectClass: top objectClass: organizationalUnit ou: WANN distinguishedName: OU=WANN,OU=Departments,DC=corp,DC=development,DC=com instanceType: 4 whenCreated: 20110405164142.0Z whenChanged: 20110405164142.0Z uSNCreated: 10913685 uSNChanged: 10913685 name: WANN objectGUID:: Eqi2LbFChke1MJ1VS9a4GA== objectCategory: CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=corp,DC=development,DC=com
'ou' is more akin to a 'directory' in a filesystem rather than something that records any useful information. What do ldapsearch's give you for 'cn=wann' and 'member=CN=RobertTest1,ou=WANN,ou=Departments,dc=corp,dc=development,dc=com'? Cheers -- Alexander Clouter .sigmonster says: You have a truly strong individuality.
Alex - as requested... ldapsearch -h xxxxxxxx -x -b ou=Departments,DC=corp,DC=development,DC=com cn=wann # extended LDIF # # LDAPv3 # base <ou=Departments,DC=corp,DC=development,DC=com> with scope subtree # filter: cn=wann # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 ldapsearch -h xxxxxxx -x -b ou=Departments,DC=corp,DC=development,DC=com member=CN=RobertTest1,ou=WANN,ou=Departments,dc=corp,dc=development,dc=com # extended LDIF # # LDAPv3 # base <ou=Departments,DC=corp,DC=development,DC=com> with scope subtree # filter: member=cn=roberttest1 # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing-... Sent from the FreeRadius - User mailing list archive at Nabble.com.
I got more info with a different query... # RobertTest1, WANN, Departments, corp.development.com dn: CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: RobertTest1 givenName: RobertTest1 distinguishedName: CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com instanceType: 4 whenCreated: 20110401191333.0Z whenChanged: 20110405164213.0Z displayName: RobertTest1 uSNCreated: 10906825 uSNChanged: 10913688 name: RobertTest1 objectGUID:: GsSgT0UjekqU6zZku/fn2A== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 129461649719116071 pwdLastSet: 12333394615881358096000007 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAJRdSujUPgdGF4vwq+QgAAA== accountExpires: 9223372036854775807 logonCount: 1 sAMAccountName: RobertTest1 sAMAccountType: 805306368 userPrincipalName: RobertTest1@corp.development.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=development,DC=com dSCorePropagationData: 20110405164213.0Z dSCorePropagationData: 20110405164213.0Z dSCorePropagationData: 20110405164213.0Z dSCorePropagationData: 16010108151513.0Z # search result search: 2 result: 0 Success # numResponses: 6 # numEntries: 5 -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing-... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (3)
-
Alexander Clouter -
joezamosc -
Phil Mayers