Cleartext-Password not found + CHAP and LDAP

[ouioui.bambin]

Hi there

I'm trying to configure my Freeradius (v 1.272) to work with an LDAP server (for a mac-based authentication). Unfortunately, switchs of the LAN send only Access-request to the RADIUS with a CHAP password, so I have to choose CHAP authentication.
I get the mac address from the LDAP and I map it in Cleartext-Password for the CHAP authentication.
LDAP mac addresses are like this "ethernet 00:11:22:33:44" so I have to modify Cleartext-Password before the authentication.


To do this, I have the following configuration:
ldap.attrmap:
...
checkItem Cleartext-Password dhcpHWAddress
...
(dhcpHWAddress being the attribute wich contains the mac-address in the LDAP)
------------------------------------------------------------------------------
sites-enabled/default:
authorize{
chap
ldap
...}
anthenticate{
...
Auth-Type CHAP {

#update control {
# Cleartext-Password := "%{User-Name}"
#}

if ( Cleartext-Password =~ /ethernet ([1-9a-zA-Z:]*)/i ) {
update control {
Cleartext-Password := "%{1}"
}
}

chap
}...
And the right configuration in the radiusd.conf.

My problem is the Cleartext-Password is unknow ("not found") when I want to modify it, but after, during the anthentication, it has its value. Here is the debug (by freeradius -X):

...
rlm_ldap: Bind was successful
rlm_ldap: performing search in dc=XXX,dc=fr, with filter (XXXXX)
rlm_ldap: No default NMAS login sequence
rlm_ldap: looking for check items in directory...
rlm_ldap: LDAP attribute dhcpHWAddress as RADIUS attribute Cleartext-Password == "ethernet 00:11:XX:XX:XX:XX"
rlm_ldap: looking for reply items in directory...
rlm_ldap: LDAP attribute dhcpVlan as RADIUS attribute Tunnel-Private-Group-Id:0 = "XXX"
rlm_ldap: user 00:11:XX:XX:XX:XX authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
rad_check_password: Found Auth-Type CHAP
auth: type "CHAP"
+- entering group CHAP
++? if (Cleartext-Password =~ /ethernet ([1-9a-ZA-Z:]*)/i )
(Attribute Cleartext-Password was not found)
rlm_chap: login attempt by "00:11:XX:XX:XX:XX" with CHAP password
rlm_chap: Using clear text password "ethernet 00:11:XX:XX:XX:XX" for user 00:11:XX:XX:XX:XX authentication.
rlm_chap: Password check failed
...


Of course if I remove the # before:
#update control {
# Cleartext-Password := "%{User-Name}"
#}

Cleartext-Password takes a new value and all is fine...

I don't understand why the Cleartext-Password take a value from the LDAP, then is not found, and finally contains the value from the LDAP for the authentication...
Could you help me, please?

Thanks
pfaf


---------------------------------------------------------------------------- 
Laposte.net fête ses 10 ans ! 

Gratuite, garantie à vie et déjà utilisée par des millions d'internautes... 
vous aussi, pour votre adresse e-mail, choisissez laposte.net. 

Laposte.net, bien + qu'une messagerie 
----------------------------------------------------------------------------