Ldap Authentication question
Ramon Escriba
escriba at cells.es
Thu Mar 31 12:14:54 CEST 2011
Alan, please do not get angry ok?,
The line in my answer about the "sarcastical reply" was for Alexander, not
for you.
Note: WIFIDATA & WIFIVOIP do 802.1x EAP+mschapv2 ok.
Here're the logs:
First authentication
--------------------------
(...)
Listening on authentication interface eth0 address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 10.0.0.1port 32770, id=29,
length=95
User-Name = "0019B976CC36"
User-Password = "0019B976CC36"
NAS-IP-Address = 10.0.0.1
Service-Type = Login-User
Calling-Station-Id = "00-19-B9-76-CC-36"
NAS-Port-Id = "2:18"
NAS-Port-Type = Ethernet
+- entering group authorize {...}
[preprocess] expand: %{NAS-Port-Id} -> 2:18
++[preprocess] returns ok
[auth_log] expand:
/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d ->
/var/log/radius/radacct/10.0.0.1/auth-detail-20110331
[auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d
expands to /var/log/radius/radacct/10.0.0.1/auth-detail-20110331
[auth_log] expand: %t -> Thu Mar 31 11:31:09 2011
++[auth_log] returns ok
++- entering policy rewrite_calling_station_id {...}
+++? if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i)
? Evaluating (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE
+++? if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE
+++- entering if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...}
expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 0019B976CC36
++++[request] returns ok
+++- if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok
+++ ... skipping else for request 0: Preceding "if" was taken
++- policy rewrite_calling_station_id returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "0019B976CC36", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[ntdomain] No '\' in User-Name = "0019B976CC36", looking up realm NULL
[ntdomain] No such realm "NULL"
++[ntdomain] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[VOIP] - ldap_xlat
[files] expand:
ldap:///ou=VOIP,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i ->
ldap:///ou=VOIP,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=0019B976CC3
6
[VOIP] ldap_get_conn: Checking Id: 0
[VOIP] ldap_get_conn: Got Id: 0
[VOIP] attempting LDAP reconnection
[VOIP] (re)connect to 127.0.0.1:389, authentication 0
[VOIP] bind as cn=Manager,dc=machine,dc=com/mypassword to 127.0.0.1:389
[VOIP] waiting for bind result ...
[VOIP] Bind was successful
[VOIP] performing search in ou=VOIP,ou=VLANS,ou=Radius,dc=machine,dc=com,
with filter uid=0019B976CC36
[VOIP] object not found
[VOIP] Search returned not found
[VOIP] ldap_release_conn: Release Id: 0
[files] expand:
%{VOIP:ldap:///ou=VOIP,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i}
->
[WIFIVOIP] - ldap_xlat
[files] expand:
ldap:///ou=WifiVoip,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i ->
ldap:///ou=WifiVoip,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=0019B97
6CC36
[WIFIVOIP] ldap_get_conn: Checking Id: 0
[WIFIVOIP] ldap_get_conn: Got Id: 0
[WIFIVOIP] attempting LDAP reconnection
[WIFIVOIP] (re)connect to 127.0.0.1:389, authentication 0
[WIFIVOIP] bind as cn=Manager,dc=machine,dc=com/mypassword to
127.0.0.1:389
[WIFIVOIP] waiting for bind result ...
[WIFIVOIP] Bind was successful
[WIFIVOIP] performing search in
ou=WifiVoip,ou=VLANS,ou=Radius,dc=machine,dc=com, with filter
uid=0019B976CC36
[WIFIVOIP] object not found
[WIFIVOIP] Search returned not found
[WIFIVOIP] ldap_release_conn: Release Id: 0
[files] expand:
%{WIFIVOIP:ldap:///ou=WifiVoip,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?
uid=%i} ->
[WIFIDATA] - ldap_xlat
[files] expand:
ldap:///ou=WifiData,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i ->
ldap:///ou=WifiData,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=0019B97
6CC36
[WIFIDATA] ldap_get_conn: Checking Id: 0
[WIFIDATA] ldap_get_conn: Got Id: 0
[WIFIDATA] attempting LDAP reconnection
[WIFIDATA] (re)connect to 127.0.0.1:389, authentication 0
[WIFIDATA] bind as cn=Manager,dc=machine,dc=com/mypassword to
127.0.0.1:389
[WIFIDATA] waiting for bind result ...
[WIFIDATA] Bind was successful
[WIFIDATA] performing search in
ou=WifiData,ou=VLANS,ou=Radius,dc=machine,dc=com, with filter
uid=0019B976CC36
[WIFIDATA] object not found
[WIFIDATA] Search returned not found
[WIFIDATA] ldap_release_conn: Release Id: 0
[files] expand:
%{WIFIDATA:ldap:///ou=WifiData,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?
uid=%i} ->
[STAFF] - ldap_xlat
[files] expand:
ldap:///ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i ->
ldap:///ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=0019B976CC
36
[STAFF] ldap_get_conn: Checking Id: 0
[STAFF] ldap_get_conn: Got Id: 0
[STAFF] attempting LDAP reconnection
[STAFF] (re)connect to 127.0.0.1:389, authentication 0
[STAFF] bind as cn=Manager,dc=machine,dc=com/mypassword to 127.0.0.1:389
[STAFF] waiting for bind result ...
[STAFF] Bind was successful
[STAFF] performing search in
ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com, with filter uid=0019B976CC36
[STAFF] Adding attribute uid, value: 0019B976CC36
[STAFF] ldap_release_conn: Release Id: 0
[STAFF] - ldap_xlat end
[files] expand:
%{STAFF:ldap:///ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i
} -> 0019B976CC36
[files] users: Matched entry DEFAULT at line 219
++[files] returns ok
Found Auth-Type = STAFF
+- entering group STAFF {...}
[STAFF] login attempt by "0019B976CC36" with password "0019B976CC36"
[STAFF] WARNING: Deprecated conditional expansion ":-". See "man unlang"
for details
[STAFF] ... expanding second conditional
[STAFF] expand: %{User-Name} -> 0019B976CC36
[STAFF] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) ->
(uid=0019B976CC36)
[STAFF] expand: ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com ->
ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com
[STAFF] ldap_get_conn: Checking Id: 0
[STAFF] ldap_get_conn: Got Id: 0
[STAFF] performing search in
ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com, with filter
(uid=0019B976CC36)
[STAFF] ldap_release_conn: Release Id: 0
[STAFF] user DN:
uid=0019B976CC36,ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com
[STAFF] (re)connect to 127.0.0.1:389, authentication 1
[STAFF] bind as
uid=0019B976CC36,ou=Staff,ou=VLANS,ou=Radius,dc=machine,dc=com/0019B976CC36
to 127.0.0.1:389
[STAFF] waiting for bind result ...
[STAFF] Bind was successful
[STAFF] user 0019B976CC36 authenticated succesfully
++[STAFF] returns ok
Login OK: [0019B976CC36] (from client OFF-Staff-extreme-network port 0 cli
0019B976CC36)
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 29 to 10.0.0.1port 32770
Extreme-Netlogin-Only = Enabled
Extreme-CLI-Authorization = Disabled
Extreme-Netlogin-Vlan = "Staff"
Reply-Message = "OK: STAFF user+device (%u %i) accepted."
Termination-Action = RADIUS-Request
Session-Timeout = 3600
Finished request 0.
Going to the next request
Waking up in 9.9 seconds.
rad_recv: Accounting-Request packet from host 10.0.0.1port 32771, id=11,
length=114
Acct-Status-Type = Start
User-Name = "0019B976CC36"
NAS-IP-Address = 10.0.0.1
Acct-Session-Id = "Thu Mar 31, 2011 10:27:11"
Service-Type = Login-User
NAS-Port = 2018
NAS-Port-Type = Ethernet
Tunnel-Private-Group-Id:0 = "4000"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Acct-Delay-Time = 0
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 2018,Client-IP-Address =
10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "Thu Mar 31, 2011
10:27:11",User-Name = "0019B976CC36"'
[acct_unique] Acct-Unique-Session-ID = "1018b7c0059e059b".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "0019B976CC36", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[ntdomain] No '\' in User-Name = "0019B976CC36", looking up realm NULL
[ntdomain] No such realm "NULL"
++[ntdomain] returns noop
++[files] returns noop
+- entering group accounting {...}
[detail] expand:
/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d ->
/var/log/radius/radacct/10.0.0.1/detail-20110331
[detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands
to /var/log/radius/radacct/10.0.0.1/detail-20110331
[detail] expand: %t -> Thu Mar 31 11:31:09 2011
++[detail] returns ok
[radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp
[radutmp] expand: %{User-Name} -> 0019B976CC36
++[radutmp] returns ok
[attr_filter.accounting_response] expand: %{User-Name} -> 0019B976CC36
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated
Sending Accounting-Response of id 11 to 10.0.0.1port 32771
Finished request 1.
Cleaning up request 1 ID 11 with timestamp +5
Going to the next request
Waking up in 9.9 seconds.
Cleaning up request 0 ID 29 with timestamp +5
Ready to process requests.
----------------SECOND AUTHENTICATION ------------------
rad_recv: Access-Request packet from host 10.0.0.1port 32770, id=30,
length=95
User-Name = "0026B9692F6F"
User-Password = "0026B9692F6F"
NAS-IP-Address = 10.0.0.1
Service-Type = Login-User
Calling-Station-Id = "00-26-B9-69-2F-6F"
NAS-Port-Id = "2:35"
NAS-Port-Type = Ethernet
+- entering group authorize {...}
[preprocess] expand: %{NAS-Port-Id} -> 2:35
++[preprocess] returns ok
[auth_log] expand:
/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d ->
/var/log/radius/radacct/10.0.0.1/auth-detail-20110331
[auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d
expands to /var/log/radius/radacct/10.0.0.1/auth-detail-20110331
[auth_log] expand: %t -> Thu Mar 31 11:32:15 2011
++[auth_log] returns ok
++- entering policy rewrite_calling_station_id {...}
+++? if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i)
? Evaluating (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE
+++? if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE
+++- entering if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...}
expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 0026B9692F6F
++++[request] returns ok
+++- if (request:Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0
-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok
+++ ... skipping else for request 2: Preceding "if" was taken
++- policy rewrite_calling_station_id returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "0026B9692F6F", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[ntdomain] No '\' in User-Name = "0026B9692F6F", looking up realm NULL
[ntdomain] No such realm "NULL"
++[ntdomain] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[STAFF2] - ldap_xlat
[files] expand:
ldap:///ou=Staff2,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=%i ->
ldap:///ou=Staff2,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=0026B9692
F6F
[STAFF2] ldap_get_conn: Checking Id: 0
[STAFF2] ldap_get_conn: Got Id: 0
[STAFF2] attempting LDAP reconnection
[STAFF2] (re)connect to 127.0.0.1:389, authentication 0
[STAFF2] bind as cn=Manager,dc=machine,dc=com/mypassword to 127.0.0.1:389
[STAFF2] waiting for bind result ...
[STAFF2] Bind was successful
[STAFF2] performing search in
ou=Staff2,ou=VLANS,ou=Radius,dc=machine,dc=com, with filter uid=0026B9692F6F
[STAFF2] object not found
[STAFF2] Search returned not found
[STAFF2] ldap_release_conn: Release Id: 0
[files] expand:
%{STAFF2:ldap:///ou=Staff2,ou=VLANS,ou=Radius,dc=machine,dc=com?uid?one?uid=
%i} ->
[files] users: Matched entry DEFAULT at line 261
++[files] returns ok
Found Auth-Type = Reject
Auth-Type = Reject, rejecting user
Failed to authenticate the user.
Login incorrect: [0026B9692F6F] (from client OFF-Staff-extreme-network port
0 cli 0026B9692F6F)
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> 0026B9692F6F
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 2 for 2 seconds
Going to the next request
Waking up in 0.9 seconds.
Waking up in 0.9 seconds.
Sending delayed reject for request 2
Sending Access-Reject of id 30 to 10.0.0.1port 32770
Reply-Message = "FAIL: REJECTED. Please call the helpdesk."
Waking up in 9.9 seconds.
More information about the Freeradius-Users
mailing list