LDAP check attributes

[Antonio Matera]

Hallo, thanks for your answers.

> 
>   It's not in the conf files.  Read the debug output.  It's in LDAP.
> 


Ok, the problem in the log file is this:

 > rlm_ldap: ldap_get_conn: Checking Id: 0
 > rlm_ldap: ldap_get_conn: Got Id: 0
 > rlm_ldap: performing search in dc=create-net,dc=org, with filter 
(uid=vlan3)
 > rlm_ldap: Added password vlan3 in check items
 > rlm_ldap: looking for check items in directory...
 > rlm_ldap: Adding radiusCiscoAVPair as Cisco-AVPair, value ssid=VLAN3 
& op=21
 > rlm_ldap: looking for reply items in directory...
 > rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11
 > rlm_ldap: Adding radiusTunnelPrivateGroupId as 
Tunnel-Private-Group-Id, value 3 & op=11
 > rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 
IEEE-802 & op=11
 > Invalid operator for item EAP-Type: reverting to '=='
 > rlm_ldap: Pairs do not match. Rejecting user.
 > rlm_ldap: ldap_release_conn: Release Id: 0
 > modcall[authorize]: module "ldap" returns reject for request 5
 > modcall: leaving group authorize (returns reject) for request 5
 > Invalid user (rlm_ldap: Pairs do not match): [vlan3/<no User-Password 
attribute>] (from client cn-radius port 276 cli 000c.f135.f1ba)
 >  PEAP: Tunneled authentication was rejected.
 >  rlm_eap_peap: FAILURE


but in the ldap.attrmap I added to the original file only:

checkItem    Cisco-AVPair    radiusCiscoAVPair

and

replyItem    Tunnel-Medium-Type    radiusTunnelMediumType
replyItem    Tunnel-Private-Group-Id    radiusTunnelPrivateGroupId
replyItem    Tunnel-Type        radiusTunnelType


my user in LDAP directory has the following attributes:


# vlan3, people, create-net.org
dn: sn=vlan3,ou=people,dc=create-net,dc=org
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: radiusprofile
radiusTunnelPrivateGroupId: 3
radiusCiscoAVPair: ssid=VLAN3
sn: vlan3
uid: vlan3
radiusTunnelMediumType: IEEE-802
radiusTunnelType: VLAN
cn: vlan3
userPassword:: dmxhbjM=



I haven't an EAP-Type entry and I don't understand where freeradius 
finds this attribute....


Bye Antonio