Help with Freeradius + OpenLDAP/Samba + 802.1x WLan auth for Windows

[Albrecht Dreß]

Hi,

sorry if my question is really dumb; I'm new to the list...

I run Freeradius 1.1.7 on a Ubuntu 8.04 LTS/x86_64 box, and want to  
have the following:
- Win XP WLan clients authenticate at an WLan access point with 802.1x;
- the access points talks to the Freeradius server;
- the user database is in OpenLDAP with the Samba schema, which  
Freeradius shall check;
- every user who can authenticate properly shall get access.

I am now at a point where Freeradius picks up the requests and  
authorises the user against ldap, but then eap authentication fails:

rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to kolab.lios-koeln.de:389, authentication 0
rlm_ldap: bind as [...] to [...]:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in [...], with filter  
(&(objectClass=inetOrgPerson)(uid=username))
rlm_ldap: Added password [...] in check items
rlm_ldap: No default NMAS login sequence
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding userPassword as User-Password == "[...]"
rlm_ldap: Adding sambaNTPassword as NT-Password == [...]
rlm_ldap: looking for reply items in directory...
rlm_ldap: user my-domain\username authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
   modcall[authorize]: module "ldap" returns ok for request 0
rlm_pap: Normalizing NT-Password from hex encoding
rlm_pap: Found existing Auth-Type, not changing it.
   modcall[authorize]: module "pap" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: Identity does not match User-Name, setting from EAP Identity.
   rlm_eap: Failed in handler
   modcall[authenticate]: module "eap" returns invalid for request 0
modcall: leaving group authenticate (returns invalid) for request 0
auth: Failed to validate the user.

Any idea what the eap error means (I do *not* have 'with_ntdomain_hack'  
enabled)?  Does anyone have a working example configuration for the  
setup above (s)he could share?

Thanks in advance, Albrecht.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20090424/84612ffe/attachment.pgp>