freeradius <---> sambaNT ldap

[Alan DeKok]

On Aug 25, 2021, at 11:05 AM, Sazzad Hossain <sazzad.suzon89 at gmail.com> wrote:
> In my ldap(productive) server user password is saved in SambaNT format.

  It's saved as just a hash, with no prefix.

> For
> test purpose i write clear test password [*radtest user CleartextPassword
> 127.0.0.1 1812 testing123*] and then obviously it shows error. Can anyone
> help me What can i do? One more question, when i will test from my test
> freeradius(server) PC to productive ldap server,should i have to write
> 127.0.0.1 in the (test)command [ *radtest user CleartextPassword 127.0.0.1
> 1812 testing123* ]?
...
> 0) Received Access-Request Id 79 from 127.0.0.1:50497 to 127.0.0.1:1812
> length 76
> (0)   User-Name = "riedel"
> (0)   User-Password = "testtest1A"
> (0)   NAS-IP-Address = 127.0.1.1
> (0)   NAS-Port = 1812
> (0)   Message-Authenticator = 0x07cfed3ddf824369cf2e958253e1f76b
> ...
> rlm_ldap (ldap): Reserved connection (0)
> (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
> (0) ldap:    --> (uid=riedel)
> (0) ldap: Performing search in "ou=people,dc=de" with filter
> "(uid=riedel)", scope "sub"
> (0) ldap: Waiting for search result...
> (0) ldap: User object found at DN "uid=riedel,ou=people,dc=de"
> (0) ldap: Processing user attributes
> (0) ldap: control:Password-With-Header += '971a62f4bb490cb69e9661cac35a2274'

The Password-With-Header attribute requires that the password is saved with a header.  i.e. {nt}971a62f4bb490cb69e9661cac35a2274

> rlm_ldap (ldap): Released connection (0)
> Need 5 more connections to reach 10 spares
> rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots
> used
> rlm_ldap (ldap): Connecting to ldap://10.9.25.56:389
> rlm_ldap (ldap): Waiting for bind result...
> rlm_ldap (ldap): Bind successful
> (0)     [ldap] = updated

  So LDAP found the user.

> (0)     [expiration] = noop
> (0)     [logintime] = noop
> (0) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password
> (0) pap: Removing &control:Password-With-Header

  That seems clear.  There's no header, so the PAP module assumes that the password is clear text.

> (0) pap: Comparing with "known good" Cleartext-Password
> *(0) pap: ERROR: Cleartext password does not match "known good" password*
> (0) pap: Passwords don't match

 i.e. "testtest1A" doesn't match "971a62f4bb490cb69e9661cac35a2274"

  The solution is either:

* add {nt} to the passwords in LDAP

* or, edit mods-enabled/ldap, and change:

		control:Password-With-Header	+= 'userPassword'

to

		control:NT-Password	+= 'userPassword'

  Alan DeKok.