check-Item checked by ldap

[Florian Prester]

Hi,

 I am using a LDAP-Directory as Information-DB for authorisation.
Now my question is:

 I want to grant access, if a user fullfills a LDAP-attribute, for example:

users-file:
...
test  LDAP-Group == "test"
        Service-Type = "Administrative-User",
        cisco-avpair= "shell:priv-lvl=15"
...


ldap.attrmap:
...
checkItem       LDAP-Group                      Userid
...

In LDAP the Iserid for the user test is test, therfore it should be 
mapped to the LDAP-Group-attribute
and therfore the user should be granted access, or not?

But the debug output shows something different:
######################################
./radiusd -XXX
rad_recv: Access-Request packet from host 232.122.28.222:2084, id=59, 
length=47
        User-Name = "test"
        User-Password = "XXX"
Fri Mar 17 08:31:44 2006 : Debug:   Processing the authorize section of 
radiusd.conf
Fri Mar 17 08:31:44 2006 : Debug: modcall: entering group authorize for 
request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: calling 
preprocess (rlm_preprocess) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: returned from 
preprocess (rlm_preprocess) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modcall[authorize]: module 
"preprocess" returns ok for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: calling chap 
(rlm_chap) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: returned from 
chap (rlm_chap) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modcall[authorize]: module "chap" 
returns noop for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: calling mschap 
(rlm_mschap) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: returned from 
mschap (rlm_mschap) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modcall[authorize]: module "mschap" 
returns noop for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: calling eap 
(rlm_eap) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   rlm_eap: No EAP-Message, not doing EAP
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: returned from 
eap (rlm_eap) for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modcall[authorize]: module "eap" 
returns noop for request 0
Fri Mar 17 08:31:44 2006 : Debug:   modsingle[authorize]: calling files 
(rlm_files) for request 0
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: Entering ldap_groupcmp()
Fri Mar 17 08:31:44 2006 : Debug: radius_xlat:  'ou=AAAuse ... '
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: attempting LDAP reconnection
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: (re)connect to 
232.122.3.22:400, authentication 0
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: bind as cn=
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: waiting for bind result ...
request done: ld 3501a58 msgid 1
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: Bind was successful
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: performing search in ou=AA 
... request done: ld 3501a58 msgid 2
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Fri Mar 17 08:31:44 2006 : Debug: radius_xlat:  
'(|(&(objectClass=GroupOfNames)(member=...'
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: performing search in ou=AAA 
... request done: ld 3501a58 msgid 3
Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: object not found or got 
ambiguous search result
###############################

Now, somemore questions:
1.) why is there a reconnect? I thought I connect to the ldap once, 
retrieve user-information and then all comparsion iis done by the RADIUS?

2.) why is there no mapping from the Userid to the LDAP-Group, but a new 
search for the ldap-attribute:
     Fri Mar 17 08:31:44 2006 : Debug: radius_xlat:  
'(|(&(objectClass=GroupOfNames)(member=...'???

Thanks
 Florian

-- 
Dipl. Inf. Florian Prester
Network Administration
Regionales RechenZentrum Erlangen
Universitaet Erlangen-Nuernberg
Martensstr. 1
91052 Erlangen
Germany

Tel.: +499131 8527813