Problem when removing Auth-Type := Ldap in users file
cxu
cxu at unbsj.ca
Thu Feb 7 19:27:14 CET 2008
Hi,
I am testing the freeradius server, and try to clarify rules applied in
freeradius. In the following trials, I could not figure out how to make
Autz-Type Ldap1 in authorize section to correctly set Auth-Type used in
authentication without the help from "Auth-Type := Ldap1".
With the following entry in users file,
**************
DEFAULT Called-Station-Id =~ ".*Guest at myu", Autz-Type := Ldap1, Auth-Type :=
Ldap1
**************
the user authentication worked fine.
Below is the debug output.
**************
rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=19,
length=98
User-Name = "tester"
Called-Station-Id = "00-1B-BA-A5-45-40:Guest at myu"
NAS-Port = 189
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "nortel"
NAS-IP-Address = 192.168.1.113
User-Password = "testing"
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
rlm_realm: No '@' in User-Name = "tester", looking up realm NULL
rlm_realm: No such realm "NULL"
++[suffix] returns noop
rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest at myu
expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest at myu
users: Matched entry DEFAULT at line 70
++[files] returns ok
rlm_pap: WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Autz-Type Ldap1
+- entering group Ldap1
++- entering redundant-load-balance group redundant-load-balance
rlm_ldap: - authorize
rlm_ldap: performing user authorization for tester
WARNING: Deprecated conditional expansion ":-". See "man unlang" for
details
expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester)
expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 0
rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/unbCA.crt
rlm_ldap: setting TLS Require Cert to never
rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap.myu.ca:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter
(uid=tester)
rlm_ldap: Added User-Password =
{SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user tester authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
+++[myldap2] returns ok
++- redundant-load-balance group redundant-load-balance returns ok
rad_check_password: Found Auth-Type Ldap1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
!!! Replacing User-Password in config items with Cleartext-Password.
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
!!! Please update your configuration so that the "known good"
!!!
!!! clear text password is in Cleartext-Password, and not in User-Password.
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
auth: type "Ldap1"
+- entering group Ldap1
++- entering redundant-load-balance group redundant-load-balance
rlm_ldap: - authenticate
rlm_ldap: login attempt by "tester" with password "testing"
rlm_ldap: user DN: uid=tester,ou=people,dc=myu,dc=ca
rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 1
rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt
rlm_ldap: setting TLS Require Cert to never
rlm_ldap: bind as uid=tester,ou=people,dc=myu,dc=ca/testing to
ldap.myu.ca:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: user tester authenticated succesfully
+++[myldap2] returns ok
++- redundant-load-balance group redundant-load-balance returns ok
Login OK: [tester] (from client unbsj113 port 189)
Sending Access-Accept of id 19 to 192.168.1.113 port 20000
Finished request 0.
Going to the next request
Waking up in 0.8 seconds.
Waking up in 4.1 seconds.
Cleaning up request 0 ID 19 with timestamp +99
Ready to process requests.
**************
However when I removed Auth-Type := Ldap1 in the entry,
**************
DEFAULT Called-Station-Id =~ ".*Guest at myu", Autz-Type := Ldap1
**************
the user authentication failed. The Auth Type is set to Local instead of
Ldap.
Below is the debug output.
**************
rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=20,
length=98
User-Name = "tester"
Called-Station-Id = "00-1B-BA-A5-45-40:Guest at myu"
NAS-Port = 192
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "nortel"
NAS-IP-Address = 192.168.1.113
User-Password = "testing"
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
rlm_realm: No '@' in User-Name = "tester", looking up realm NULL
rlm_realm: No such realm "NULL"
++[suffix] returns noop
rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest at myu
expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest at myu
users: Matched entry DEFAULT at line 71
++[files] returns ok
rlm_pap: WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Autz-Type Ldap1
+- entering group Ldap1
++- entering redundant-load-balance group redundant-load-balance
rlm_ldap: - authorize
rlm_ldap: performing user authorization for tester
WARNING: Deprecated conditional expansion ":-". See "man unlang" for
details
expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester)
expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to ldap2.myu.ca:389, authentication 0
rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt
rlm_ldap: setting TLS Require Cert to never
rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap2.myu.ca:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter
(uid=tester)
rlm_ldap: Added User-Password =
{SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user tester authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
+++[myldap] returns ok
++- redundant-load-balance group redundant-load-balance returns ok
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
!!! Replacing User-Password in config items with Cleartext-Password.
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
!!! Please update your configuration so that the "known good"
!!!
!!! clear text password is in Cleartext-Password, and not in User-Password.
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
auth: type Local
auth: user supplied User-Password does NOT match local User-Password
auth: Failed to validate the user.
Login incorrect: [tester] (from client unbsj113 port 192)
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 20 to 192.168.1.113 port 20000
Waking up in 4.9 seconds.
Cleaning up request 0 ID 20 with timestamp +111
Ready to process requests.
**************
In radiusd.conf,
ldap myldap {
server = "ldap2.myu.ca"
identity = "uid=radius,dc=myu,dc=ca"
password = PWD12345678
basedn = "ou=people,dc=myu,dc=ca"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
ldap_connections_number = 5
timeout = 4
timelimit = 3
net_timeout = 1
tls {
start_tls = no
# cacertfile = /path/to/cacert.pem
# cacertdir = /path/to/ca/dir/
# certfile = /path/to/radius.crt
cacertfile = /usr/local/etc/raddb/certs/myuCA.crt
# keyfile = /path/to/radius.key
# randfile = /path/to/rnd
require_cert = "never"
}
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
# access_attr = "dialupAccess"
dictionary_mapping = ${confdir}/ldap.attrmap
password_attribute = userPassword
# password_header = "{clear}"
edir_account_policy_check = no
# groupname_attribute = cn
# groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO
fUniqueNames)(uniquemember=%{Ldap-UserDn})))"
# groupmembership_attribute = radiusGroupName
groupmembership_attribute = eduPersonPrimaryAffiliation
# compare_check_items = yes
# do_xlat = yes
# access_attr_used_for_allow = yes
set_auth_type = yes
#ldap_debug = 0x0028
}
ldap myldap2 {
...
}
authorize {
...
Autz-Type Ldap1 {
redundant-load-balance{
myldap
myldap2
}
}
...
}
authenticate {
...
Auth-Type Ldap1 {
redundant-load-balance{
myldap
myldap2
}
}
...
}
Thanks for your help!
Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20080207/ae56244f/attachment.html>
More information about the Freeradius-Users
mailing list