Can I get group-name from Active-directory? [sec=unclassified]

[Hangjun He]

I add group parameters in rlm_ldap section. Seems freeradius not do group search. 
          groupname_attribute = memberOf
        groupmembership_filter = "(cn=%{Stripped-User-Name:-%{User-Name}})"
   
  Anything else I need to configure in radiusd.conf?
   
  Waking up in 4 seconds...
rad_recv: Access-Request packet from host 10.155.20.84:1107, id=76, length=207
        User-Name = "hhe"
        NAS-IP-Address = 10.155.20.84
        NAS-Identifier = "AH-000030"
        NAS-Port = 0
        Called-Station-Id = "00-19-77-00-00-34:hhe"
        Calling-Station-Id = "00-19-E0-80-A5-5A"
        Framed-MTU = 1500
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 11Mbps 802.11b"
        EAP-Message = 0x0209002b1900170301002040c3edccfa02df3abe7e25e10b19562d21e7cb9ae131741e2072d61ea88ada83
        State = 0xaa50cdb6191621d7112990ba865f4031
        Message-Authenticator = 0xb16d6265031bcb1157450cdbef3d80b4
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 9
  modcall[authorize]: module "preprocess" returns ok for request 9
  modcall[authorize]: module "mschap" returns noop for request 9
    rlm_realm: No '@' in User-Name = "hhe", looking up realm NULL
    rlm_realm: Found realm "NULL"
    rlm_realm: Proxying request from user hhe to realm NULL
    rlm_realm: Adding Realm = "NULL"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "suffix" returns noop for request 9
  rlm_eap: EAP packet type response id 9 length 43
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 9
rlm_ldap: - authorize
rlm_ldap: performing user authorization for hhe
radius_xlat:  '(sAMAccountName=hhe)'
radius_xlat:  'cn=users,dc=aerohive, dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in cn=users,dc=aerohive, dc=com, with filter (sAMAccountName=hhe)
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user hhe authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
  modcall[authorize]: module "ldap" returns ok for request 9
modcall: leaving group authorize (returns updated) for request 9
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 9
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/peap
  rlm_eap: processing type peap
  rlm_eap_peap: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
  eaptls_process returned 7
  rlm_eap_peap: EAPTLS_OK
  rlm_eap_peap: Session established.  Decoding tunneled attributes.
  rlm_eap_peap: Received EAP-TLV response.
  rlm_eap_peap: Tunneled data is valid.
  rlm_eap_peap: Success
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns ok for request 9
modcall: leaving group authenticate (returns ok) for request 9
Sending Access-Accept of id 76 to 10.155.20.84 port 1107
        MS-MPPE-Recv-Key = 0x03ee0b3dcbfc176840b2fd59f80ea717e985f078073c8aec6443244ff871091d
        MS-MPPE-Send-Key = 0x55a504ccb0cb76ee9bda1bd4e5ec48cf4c27fe94c9e086bc990ed0f0f1650f92
        EAP-Message = 0x03090004
        Message-Authenticator = 0x00000000000000000000000000000000
        User-Name = "hhe"
Finished request 9
   
  

"Ranner, Frank MR" <Frank.Ranner at defence.gov.au> 写道：
  From:
freeradius-users-bounces+frank.ranner=defence.gov.au at lists.freeradius.or
g
[mailto:freeradius-users-bounces+frank.ranner=defence.gov.au at lists.freer
adius.org] On Behalf Of Hangjun He
Sent: Monday, 17 December 2007 18:32
To: FreeRadius users mailing list
Subject: Can I get group-name from Active-directory?



FreeRADIUS 1.1.6 + samba-tools + active-directory.
Can I get user's group-name by rlm_ldap? How?


Following is result of ldap-search.(Using ldap client)
# Paul Le, Users, test.com
dn: CN=Paul Le,CN=Users,DC=test,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Paul Le
sn: Levasseur
distinguishedName: CN=Paul Le,CN=Users,DC=test,DC=com
instanceType: 4
whenCreated: 20061118204047.0Z
whenChanged: 20061120041505.0Z
displayName: Paul Levasseur
uSNCreated: 53309
memberOf: CN=WirelessUsers,CN=Users,DC=test,DC=com
uSNChanged: 61454
name: Paul Levasseur
objectGUID:: TWcfmIP0S0KptrqNYMartA==


In radiusd.conf set the ldap group parameters:

groupname_attribute = memberOf
groupmembership_filter = "(cn=%{Stripped-User-Name:-%{User-Name}})"

If you prefer you can use sAMAccountName instead of cn, or even both:

groupmembership_filter =
"(|(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-Us
er-Name:-%{User-Name}}))"

Regards,
Frank Ranner

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


       
---------------------------------
雅虎邮箱传递新年祝福，个性贺卡送亲朋！ 
       
---------------------------------
雅虎邮箱传递新年祝福，个性贺卡送亲朋！ 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20071219/5ae87ae8/attachment.html>