LDAP-group filter search is failing

[Phil Mayers]

On 04/07/2011 10:06 PM, joezamosc wrote:
> 2.1.10
>
> Here's a snippet of freeradius -X...
>
> +- entering group post-auth {...}
>    [ldap] Entering ldap_groupcmp()
> [files]         expand: ou=Departments,dc=corp,dc=development,dc=com ->
> ou=Departments,dc=corp,dc=development,dc=com
> [files]         expand: (&(sAMAccountName=%{mschap:User-Name})) ->
> (&(sAMAccountName=RobertTest1))
>    [ldap] ldap_get_conn: Checking Id: 0
>    [ldap] ldap_get_conn: Got Id: 0
>    [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com,
> with filter (&(sAMAccountName=RobertTest1))
>    [ldap] ldap_release_conn: Release Id: 0
> [files]         expand:
> (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))
> ->

You are using Active Directory, and this LDAP filter is invalid.

You want:

(&(objectClass=group)(member=%{control:Ldap-UserDn}))