Default ldap fallthrough but no Auth-Type set

[Harry Hoffman]

Hi All,

I'm running freeradius 2.1.8 on a Redhat 5.x box. We're setup to
authenticate against LDAP and AD using the how-tos and wiki on the
freeradius website. Users might be in LDAP, or AD, or both.

I've stuck with the default config and enabled both ldap and ntlm_auth
(after making sure that both sources can authenticate per the docs).
Both sources of authentication work.

It seems that when enabling the ldap module, it become the default if
nothing else sets the Auth-Type.

Now I'm trying to walk through the exercise of getting AD auth to work
if a user is present in AD, or getting LDAP auth to work if the user is
present in LDAP.

In the authorize { ... } section of sites-enabled/default I have the
following:
ntlm_auth
ldap {
	notfound = return
}

In the authenticate { ... } section of sites-enabled/default I have the
following Auth-Type:

        #  ntlm_auth authentication.
        Auth-Type ntlm_auth {
                ntlm_auth
        }

        Auth-Type LDAP {
                group{
                        ldap{
                                reject = 1
                                ok = return
                        }
                        ntlm_auth{
                                reject = 1
                                ok = return
                        }
                }
        }

If the user has a entry in the LDAP database then the Auth-Type is set
to LDAP and the authorization jumps to Auth-Type LDAP and goes through
the groups stanza trying to authenticate to ldap or ntlm_auth.

However if the user is not in LDAP then it seems as though Auth-Type is
never set so the default authentication is attempted via ldap, which
fails. I don't understand why it doesn't try the Auth-Type LDAP
definition.

Everywhere I read, the docs say not to specifically set Auth-Type but to
let the server figure it out. So, how do I let the server figure out
that the Auth-Type should be ntlm_auth when the authorize { ... }
section matches ntlm_auth?


rad_recv: Access-Request packet from host 127.0.0.1 port 55874, id=200,
length=63
	User-Name = "admin"
	User-Password = "password"
	NAS-IP-Address = 192.168.1.1
	NAS-Port = 0
+- entering group authorize {...}
++[preprocess] returns ok
[auth_log]
expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d
-> /var/log/radius/radacct/127.0.0.1/auth-detail-20100930
[auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m
%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20100930
[auth_log] 	expand: %t -> Thu Sep 30 10:32:05 2010
++[auth_log] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "admin", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[ntdomain] No '\' in User-Name = "admin", looking up realm NULL
[ntdomain] No such realm "NULL"
++[ntdomain] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
[ntlm_auth] 	expand: --username=%{mschap:User-Name} -> --username=admin
[ntlm_auth] 	expand: --password=%{User-Password} -> --password=password
Exec-Program output: NT_STATUS_OK: Success (0x0) 
Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) 
Exec-Program: returned: 0
++[ntlm_auth] returns ok
[ldap] performing user authorization for admin
[ldap] 	expand: %{Stripped-User-Name} -> 
[ldap] 	... expanding second conditional
[ldap] 	expand: %{User-Name} -> admin
[ldap] 	expand: (&(uid=
%{%{Stripped-User-Name}:-%{User-Name}})(!(inetCOS=802.1x_disabled))) ->
(&(uid=admin)(!(inetCOS=802.1x_disabled)))
[ldap] 	expand: ou=People,dc=ip-solutions,dc=net,o=internet ->
ou=People,dc=ip-solutions,dc=net,o=internet
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] attempting LDAP reconnection
  [ldap] (re)connect to ldap.ip-solutions.net:389, authentication 0
  [ldap] starting TLS
  [ldap] bind as / to ldap.ip-solutions.net:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
  [ldap] performing search in
ou=People,dc=ip-solutions,dc=net,o=internet, with filter
(&(uid=admin)(!(inetCOS=802.1x_disabled)))
  [ldap] object not found
[ldap] search failed
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns notfound
No authenticate method (Auth-Type) configuration found for the request:
Rejecting the user
Failed to authenticate the user.
Login incorrect (  [ldap] User not found): [admin] (from client
localhost port 0)
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject] 	expand: %{User-Name} -> admin
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.7 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 200 to 127.0.0.1 port 55874
Waking up in 4.9 seconds.
Cleaning up request 0 ID 200 with timestamp +3
Ready to process requests.


Cheers,
Harry