Unable to authenticate to Open Directory

Kerry Tobin kwtobin at wisc.edu
Tue Nov 4 16:43:45 CET 2008


OK, I've tried using a proxy and now it fails on rlm_eap and says the  
User-Name doesn't match EAP Identity.  Is there a way to have EAP  
processed on the local machine but authentication happen on the  
remote?  Is that even the problem?

Kerry Tobin

Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /private/etc/raddb/proxy.conf
Config:   including file: /private/etc/raddb/clients.conf
Config:   including file: /private/etc/raddb/snmp.conf
Config:   including file: /private/etc/raddb/eap.conf
Config:   including file: /private/etc/raddb/sql.conf
  main: prefix = "/"
  main: localstatedir = "/private/var"
  main: logdir = "/private/var/log/radius"
  main: libdir = "//lib"
  main: radacctdir = "/private/var/log/radius/radacct"
  main: hostname_lookups = no
  main: max_request_time = 30
  main: cleanup_delay = 5
  main: max_requests = 1024
  main: delete_blocked_requests = 0
  main: port = 0
  main: allow_core_dumps = no
  main: log_stripped_names = no
  main: log_file = "/private/var/log/radius/radius.log"
  main: log_auth = no
  main: log_auth_badpass = no
  main: log_auth_goodpass = no
  main: pidfile = "/private/var/run/radiusd/radiusd.pid"
  main: user = "(null)"
  main: group = "(null)"
  main: usercollide = no
  main: lower_user = "no"
  main: lower_pass = "no"
  main: nospace_user = "no"
  main: nospace_pass = "no"
  main: checkrad = "//sbin/checkrad"
  main: proxy_requests = yes
  proxy: retry_delay = 5
  proxy: retry_count = 3
  proxy: synchronous = no
  proxy: default_fallback = yes
  proxy: dead_time = 120
  proxy: post_proxy_authorize = no
  proxy: wake_all_if_all_dead = no
  security: max_attributes = 200
  security: reject_delay = 1
  security: status_server = no
  main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Loaded exec
  exec: wait = yes
  exec: program = "(null)"
  exec: input_pairs = "request"
  exec: output_pairs = "(null)"
  exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
  pap: encryption_scheme = "crypt"
  pap: auto_header = no
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
  mschap: use_mppe = yes
  mschap: require_encryption = no
  mschap: require_strong = no
  mschap: with_ntdomain_hack = no
  mschap: passwd = "(null)"
  mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded opendirectory
  opendirectory: passwd = "(null)"
Module: Instantiated opendirectory (opendirectory)
Module: Loaded System
  unix: cache = no
  unix: passwd = "(null)"
  unix: shadow = "(null)"
  unix: group = "(null)"
  unix: radwtmp = "/private/var/log/radius/radwtmp"
  unix: usegroup = no
  unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
  eap: default_eap_type = "ttls"
  eap: timer_expire = 60
  eap: ignore_unknown_eap_types = no
  eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type leap
  gtc: challenge = "Password: "
  gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
  tls: rsa_key_exchange = no
  tls: dh_key_exchange = yes
  tls: rsa_key_length = 512
  tls: dh_key_length = 512
  tls: verify_depth = 0
  tls: CA_path = "(null)"
  tls: pem_file_type = yes
  tls: private_key_file = "/etc/certificates/Default.key"
  tls: certificate_file = "/etc/certificates/Default.crt"
  tls: CA_file = "/etc/certificates/Default.crt"
  tls: private_key_password = ""
  tls: dh_file = "/private/etc/raddb/certs/dh"
  tls: random_file = "/private/etc/raddb/certs/random"
  tls: fragment_size = 1024
  tls: include_length = yes
  tls: check_crl = no
  tls: check_cert_cn = "(null)"
  tls: cipher_list = "(null)"
  tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
  ttls: default_eap_type = "mschapv2"
  ttls: copy_request_to_tunnel = no
  ttls: use_tunneled_reply = no
rlm_eap: Loaded and initialized type ttls
  peap: default_eap_type = "mschapv2"
  peap: copy_request_to_tunnel = no
  peap: use_tunneled_reply = no
  peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
  mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
  preprocess: huntgroups = "/private/etc/raddb/huntgroups"
  preprocess: hints = "/private/etc/raddb/hints"
  preprocess: with_ascend_hack = no
  preprocess: ascend_channels_per_line = 23
  preprocess: with_ntdomain_hack = no
  preprocess: with_specialix_jetstream_hack = no
  preprocess: with_cisco_vsa_hack = no
  preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
  realm: format = "suffix"
  realm: delimiter = "@"
  realm: ignore_default = no
  realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
  files: usersfile = "/private/etc/raddb/users"
  files: acctusersfile = "/private/etc/raddb/acct_users"
  files: preproxy_usersfile = "/private/etc/raddb/preproxy_users"
  files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
  acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,  
Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
  detail: detailfile = "/private/var/log/radius/radacct/%{Client-IP- 
Address}/detail-%Y%m%d"
  detail: detailperm = 384
  detail: dirperm = 493
  detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
  radutmp: filename = "/private/var/log/radius/radutmp"
  radutmp: username = "%{User-Name}"
  radutmp: case_sensitive = yes
  radutmp: check_with_nas = yes
  radutmp: perm = 384
  radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Module: Loaded SQL
  sql: driver = "rlm_sql_sqlite"
  sql: server = "localhost"
  sql: port = ""
  sql: login = "root"
  sql: password = "rootpass"
  sql: radius_db = "radius"
  sql: nas_table = "nas"
  sql: sqltrace = no
  sql: sqltracefile = "/private/var/log/radius/sqltrace.sql"
  sql: readclients = yes
  sql: deletestalesessions = yes
  sql: num_sql_socks = 5
  sql: sql_user_name = "%{User-Name}"
  sql: default_user_profile = ""
  sql: query_on_not_found = no
  sql: authorize_check_query = "SELECT id, UserName, Attribute, Value,  
op           FROM radcheck           WHERE Username = '%{SQL-User- 
Name}'           ORDER BY id"
  sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value,  
op           FROM radreply           WHERE Username = '%{SQL-User- 
Name}'           ORDER BY id"
  sql: authorize_group_check_query = "SELECT  
radgroupcheck 
.id 
,radgroupcheck 
.GroupName 
,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM  
radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}'  
AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY  
radgroupcheck.id"
  sql: authorize_group_reply_query = "SELECT  
radgroupreply 
.id 
,radgroupreply 
.GroupName 
,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM  
radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}'  
AND usergroup.GroupName = radgroupreply.GroupName ORDER BY  
radgroupreply.id"
  sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S',  
AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime),  
AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct- 
Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND  
NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'"
  sql: accounting_update_query = "           UPDATE radacct            
SET              FramedIPAddress = '%{Framed-IP- 
Address}',              AcctSessionTime     = '%{Acct-Session- 
Time}',              AcctInputOctets     = '%{Acct-Input- 
Gigawords:-0}'  << 32 |                                    '%{Acct- 
Input-Octets:-0}',              AcctOutputOctets    = '%{Acct-Output- 
Gigawords:-0}' << 32 |                                    '%{Acct- 
Output-Octets:-0}'           WHERE AcctSessionId = '%{Acct-Session- 
Id}'           AND UserName        = '%{SQL-User-Name}'           AND  
NASIPAddress    = '%{NAS-IP-Address}'"
  sql: accounting_update_query_alt = "           INSERT INTO  
radacct             (AcctSessionId,    AcctUniqueId,       
UserName,              Realm,            NASIPAddress,       
NASPortId,              NASPortType,      AcctStartTime,      
AcctSessionTime,              AcctAuthentic,    ConnectInfo_start,  
AcctInputOctets,              AcctOutputOctets, CalledStationId,    
CallingStationId,              ServiceType,      FramedProtocol,     
FramedIPAddress,              AcctStartDelay,    
XAscendSessionSvrKey)           VALUES             ('%{Acct-Session- 
Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User- 
Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS- 
Port}',              '%{NAS-Port-Type}',               
DATE_SUB('%S',                       INTERVAL (%{Acct-Session-Time:-0}  
+                                 %{Acct-Delay-Time:-0})  
SECOND),                       '%{Acct-Session-Time}',              '% 
{Acct-Authentic}', '',              '%{Acct-Input-Gigawords:-0}' << 32  
|              '%{Acct-Input-Octets:-0}',              '%{Acct-Output- 
Gigawords:-0}' << 32 |              '%{Acct-Output- 
Octets:-0}',              '%{Called-Station-Id}', '%{Calling-Station- 
Id}',              '%{Service-Type}', '%{Framed- 
Protocol}',              '%{Framed-IP-Address}',              '0', '% 
{X-Ascend-Session-Svr-Key}')"
  sql: accounting_start_query = "           INSERT INTO  
radacct             (AcctSessionId,    AcctUniqueId,      
UserName,              Realm,            NASIPAddress,      
NASPortId,              NASPortType,      AcctStartTime,     
AcctStopTime,              AcctSessionTime,  AcctAuthentic,     
ConnectInfo_start,              ConnectInfo_stop, AcctInputOctets,   
AcctOutputOctets,              CalledStationId,  CallingStationId,  
AcctTerminateCause,              ServiceType,      FramedProtocol,    
FramedIPAddress,              AcctStartDelay,   AcctStopDelay,     
XAscendSessionSvrKey)           VALUES             ('%{Acct-Session- 
Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User- 
Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS- 
Port}',              '%{NAS-Port-Type}', '%S', '0',              '0',  
'%{Acct-Authentic}', '%{Connect-Info}',              '', '0',  
'0',              '%{Called-Station-Id}', '%{Calling-Station-Id}',  
'',              '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- 
Address}',              '%{Acct-Delay-Time:-0}', '0', '%{X-Ascend- 
Session-Svr-Key}')"
  sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime  
= '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '% 
{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND  
UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'"
  sql: accounting_stop_query = "           UPDATE radacct  
SET              AcctStopTime       = '%S',               
AcctSessionTime    = '%{Acct-Session-Time}',               
AcctInputOctets    = '%{Acct-Input-Gigawords:-0}' << 32  
|                                   '%{Acct-Input- 
Octets:-0}',              AcctOutputOctets   = '%{Acct-Output- 
Gigawords:-0}' << 32 |                                   '%{Acct- 
Output-Octets:-0}',              AcctTerminateCause = '%{Acct- 
Terminate-Cause}',              AcctStopDelay      = '%{Acct-Delay- 
Time:-0}',              ConnectInfo_stop   = '%{Connect- 
Info}'           WHERE AcctSessionId   = '%{Acct-Session- 
Id}'           AND UserName          = '%{SQL-User-Name}'            
AND NASIPAddress      = '%{NAS-IP-Address}'"
  sql: accounting_stop_query_alt = "           INSERT INTO  
radacct             (AcctSessionId, AcctUniqueId,  
UserName,              Realm, NASIPAddress, NASPortId,               
NASPortType, AcctStartTime, AcctStopTime,               
AcctSessionTime, AcctAuthentic, ConnectInfo_start,               
ConnectInfo_stop, AcctInputOctets, AcctOutputOctets,               
CalledStationId, CallingStationId, AcctTerminateCause,               
ServiceType, FramedProtocol, FramedIPAddress,               
AcctStartDelay, AcctStopDelay)           VALUES             ('%{Acct- 
Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User- 
Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS- 
Port}',              '%{NAS-Port-Type}',               
DATE_SUB('%S',                  INTERVAL (%{Acct-Session-Time:-0}  
+                  %{Acct-Delay-Time:-0}) SECOND),              '%S',  
'%{Acct-Session-Time}', '%{Acct-Authentic}', '',              '% 
{Connect-Info}',              '%{Acct-Input-Gigawords:-0}' << 32  
|              '%{Acct-Input-Octets:-0}',              '%{Acct-Output- 
Gigawords:-0}' << 32 |              '%{Acct-Output- 
Octets:-0}',              '%{Called-Station-Id}', '%{Calling-Station- 
Id}',              '%{Acct-Terminate-Cause}',              '%{Service- 
Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',               
'0', '%{Acct-Delay-Time:-0}')"
  sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE  
UserName='%{SQL-User-Name}'"
  sql: connect_failure_retry_delay = 60
  sql: simul_count_query = ""
  sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId,  
UserName,                                NASIPAddress, NASPortId,  
FramedIPAddress,                                CallingStationId,  
FramedProtocol                                FROM  
radacct                                WHERE UserName='%{SQL-User- 
Name}'                                AND AcctStopTime = 0"
  sql: postauth_query = "INSERT into radpostauth (user, pass, reply,  
date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '% 
{reply:Packet-Type}', NOW())"
  sql: safe-characters =  
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded  
and linked
rlm_sql (sql): Attempting to connect to root at localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0
rlm_sql_sqlite: Opening sqlite database for #0
rlm_sql_sqlite: sqlite3_open() = 0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1
rlm_sql_sqlite: Opening sqlite database for #1
rlm_sql_sqlite: sqlite3_open() = 0
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2
rlm_sql_sqlite: Opening sqlite database for #2
rlm_sql_sqlite: sqlite3_open() = 0
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3
rlm_sql_sqlite: Opening sqlite database for #3
rlm_sql_sqlite: sqlite3_open() = 0
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4
rlm_sql_sqlite: Opening sqlite database for #4
rlm_sql_sqlite: sqlite3_open() = 0
rlm_sql (sql): Connected new DB handle, #4
rlm_sql (sql): - generate_sql_clients
rlm_sql (sql): Query: SELECT * FROM nas
rlm_sql (sql): Reserving sql socket id: 4
rlm_sql_sqlite: sqlite3_prepare() = 0
rlm_sql_sqlite: sqlite3_step = 100
rlm_sql (sql): Read entry  
nasname=10.0.1.81,shortname=RadiusServ,secret=testing123
rlm_sql (sql): Adding client 10.0.1.81 (RadiusServ) to clients list
rlm_sql_sqlite: sqlite3_step = 101
rlm_sql_sqlite: sqlite3_finalize() = 0
rlm_sql (sql): Released sql socket id: 4
Module: Instantiated sql (sql)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 10.0.1.81:1814, id=1,  
length=136
	User-Name = "testuser"
	Framed-MTU = 1400
	Called-Station-Id = "0012.014d.d511"
	Calling-Station-Id = "001f.5bbe.f006"
	Service-Type = Login-User
	Message-Authenticator = 0xcb3a97dde57e8f67081dc5e3d1b9c75f
	EAP-Message = 0x020200140142494f4348454d5c6b77746f62696e
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 26082
	NAS-IP-Address = 10.0.1.18
	Proxy-State = 0x323430
   Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
   modcall[authorize]: module "preprocess" returns ok for request 0
   modcall[authorize]: module "chap" returns noop for request 0
   modcall[authorize]: module "mschap" returns noop for request 0
     rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
     rlm_realm: No such realm "NULL"
   modcall[authorize]: module "suffix" returns noop for request 0
   rlm_eap: EAP packet type response id 2 length 20
   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
   modcall[authorize]: module "eap" returns updated for request 0
     users: Matched entry DEFAULT at line 153
   modcall[authorize]: module "files" returns ok for request 0
rlm_opendirectory: The SACL group "com.apple.access_radius" does not  
exist on this system.
rlm_opendirectory: The host 10.0.1.81 does not have an access group.
rlm_opendirectory: no access control groups, all users allowed.
   modcall[authorize]: module "opendirectory" returns ok for request 0
modcall: leaving group authorize (returns updated) for request 0
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: Identity does not match User-Name, setting from EAP Identity.
   rlm_eap: Failed in handler
   modcall[authenticate]: module "eap" returns invalid for request 0
modcall: leaving group authenticate (returns invalid) for request 0
auth: Failed to validate the user.
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 1 to 10.0.1.81 port 1814
	Proxy-State = 0x323430
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 1 with timestamp 49106a06
Nothing to do.  Sleeping until we see a request.


On Nov 3, 2008, at 1:01 PM, freeradius-users-request at lists.freeradius.org 
  wrote:

>
>
> Message: 3
> Date: Mon, 03 Nov 2008 15:45:44 +0100
> From: <tnt at kalik.net>
> Subject: Re: Unable to authenticate to Open Directory
> To: "FreeRadius users mailing list"
> 	<freeradius-users at lists.freeradius.org>
> Message-ID: <YjVYPK5R.1225723544.6673350.tnt at kalik.net>
> Content-Type: text/plain; charset=ISO-8859-2
>
>> Still fails when with_ntdomain_hack is enabled...
>>
> ..
>>   rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN
>> \testuser"
>>   rlm_realm: Found realm "DOMAIN"
>>   rlm_realm: Adding Stripped-User-Name = "testuser"
>>   rlm_realm: Proxying request from user testuser to realm DOMAIN
>>   rlm_realm: Adding Realm = "DOMAIN"
>>   rlm_realm: Authentication realm is LOCAL.
>
> You need to proxy for real. Not locally as those are not stripped.  
> There
> should be a proxy server sending requests to this one and stripping  
> out
> the DOMAIN bit.
>
> Ivan Kalik
> Kalik Informatika ISP
>




More information about the Freeradius-Users mailing list