Troubleshooting FreeRadius +LDAP

Commonn Systems admin at commonn.com
Mon Sep 12 21:27:20 CEST 2011


I am not a Pro neither, but I have had my share of sleepless nights 
trying to figure out the same issues here. The problem does not seem to 
be freeradius here but the LDAP server
The LDAP module cannot find the user "user1" in the LDAP database even 
though it successfully connected to it.
Try to locate "user1" in the directory using ldapsearch or another tool 
, then use that information in you basedn info (in ldap.conf). Users are 
generally stored in the cn=users,dc=domain,dc=tld container
I have found that with AD the ldap module cannot seem to find anything 
when searching the root of the domain ...

Gondar





On 9/12/2011 10:16 AM, Ricardo Sousa wrote:
> Greetings list users,
> I'm trying setup FreeRadius to work with LDAP in a deployment of 
> ClearOS and have followed this How-To 
> http://www.clearfoundation.com/docs/howtos/setting_up_freeradius2_to_use_ldap and 
> this How-To 
> http://deployingradius.com/documents/configuration/pap.html with 
> success, up to the part of the inital radtest with credentials 
> inserted in the users file. But when trying to use credentials from 
> the LDAP directory, the Radius server returns an Access-Reject packet.
> Below is the output from the debug mode.
> ***************************************************
> login as: root
> root at 192.168.3.5's <mailto:root at 192.168.3.5%27s> password:
> Last login: Mon Sep 12 13:31:45 2011 from 192.168.3.2
> [root at system ~]# service radiusd stop
> Stopping RADIUS server:                                    [  OK  ]
> [root at system ~]# radiusd -X
> FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on May 
> 19 2010 at 13:10:59
> Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
> PARTICULAR PURPOSE.
> You may redistribute copies of FreeRADIUS under the terms of the
> GNU General Public License v2.
> Starting - reading configuration files ...
> including configuration file /etc/raddb/radiusd.conf
> including configuration file /etc/raddb/proxy.conf
> including configuration file /etc/raddb/clearos-clients.conf
> including files in directory /etc/raddb/modules/
> including configuration file /etc/raddb/modules/radutmp
> including configuration file /etc/raddb/modules/smbpasswd
> including configuration file /etc/raddb/modules/realm
> including configuration file /etc/raddb/modules/etc_group
> including configuration file /etc/raddb/modules/attr_rewrite
> including configuration file /etc/raddb/modules/wimax
> including configuration file /etc/raddb/modules/detail
> including configuration file /etc/raddb/modules/logintime
> including configuration file /etc/raddb/modules/detail.example.com
> including configuration file /etc/raddb/modules/files
> including configuration file /etc/raddb/modules/counter
> including configuration file /etc/raddb/modules/acct_unique
> including configuration file /etc/raddb/modules/ippool
> including configuration file /etc/raddb/modules/exec
> including configuration file /etc/raddb/modules/inner-eap
> including configuration file /etc/raddb/modules/always
> including configuration file /etc/raddb/modules/passwd
> including configuration file /etc/raddb/modules/expiration
> including configuration file /etc/raddb/modules/checkval
> including configuration file /etc/raddb/modules/linelog
> including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
> including configuration file /etc/raddb/modules/digest
> including configuration file /etc/raddb/modules/mschap
> including configuration file /etc/raddb/modules/detail.log
> including configuration file /etc/raddb/modules/echo
> including configuration file /etc/raddb/modules/sradutmp
> including configuration file /etc/raddb/modules/mac2ip
> including configuration file /etc/raddb/modules/mac2vlan
> including configuration file /etc/raddb/modules/pam
> including configuration file /etc/raddb/modules/smsotp
> including configuration file /etc/raddb/modules/ldap
> including configuration file /etc/raddb/modules/unix
> including configuration file /etc/raddb/modules/pap
> including configuration file /etc/raddb/modules/sql_log
> including configuration file /etc/raddb/modules/policy
> including configuration file /etc/raddb/modules/expr
> including configuration file /etc/raddb/modules/attr_filter
> including configuration file /etc/raddb/modules/perl
> including configuration file /etc/raddb/modules/cui
> including configuration file /etc/raddb/modules/preprocess
> including configuration file /etc/raddb/modules/otp
> including configuration file /etc/raddb/modules/chap
> including configuration file /etc/raddb/clearos-eap.conf
> including configuration file /etc/raddb/policy.conf
> including files in directory /etc/raddb/sites-enabled/
> including configuration file /etc/raddb/sites-enabled/control-socket
> including configuration file /etc/raddb/sites-enabled/inner-tunnel
> including configuration file /etc/raddb/sites-enabled/default
> including configuration file /etc/raddb/sites-enabled/clearos-inner-tunnel
> group = radiusd
> user = radiusd
> including dictionary file /etc/raddb/dictionary
> main {
>         prefix = "/usr"
>         localstatedir = "/var"
>         logdir = "/var/log/radius"
>         libdir = "/usr/lib/freeradius"
>         radacctdir = "/var/log/radius/radacct"
>         hostname_lookups = no
>         max_request_time = 30
>         cleanup_delay = 5
>         max_requests = 1024
>         allow_core_dumps = no
>         pidfile = "/var/run/radiusd/radiusd.pid"
>         checkrad = "/usr/sbin/checkrad"
>         debug_level = 0
>         proxy_requests = yes
>  log {
>         stripped_names = no
>         auth = no
>         auth_badpass = no
>         auth_goodpass = no
>  }
>  security {
>         max_attributes = 200
>         reject_delay = 1
>         status_server = yes
>  }
> }
> radiusd: #### Loading Realms and Home Servers ####
>  proxy server {
>         retry_delay = 5
>         retry_count = 3
>         default_fallback = no
>         dead_time = 120
>         wake_all_if_all_dead = no
>  }
>  home_server localhost {
>         ipaddr = 127.0.0.1
>         port = 1812
>         type = "auth"
>         secret = "testing123"
>         response_window = 20
>         max_outstanding = 65536
>         require_message_authenticator = no
>         zombie_period = 40
>         status_check = "status-server"
>         ping_interval = 30
>         check_interval = 30
>         num_answers_to_alive = 3
>         num_pings_to_alive = 3
>         revive_interval = 120
>         status_check_timeout = 4
>         irt = 2
>         mrt = 16
>         mrc = 5
>         mrd = 30
>  }
>  home_server_pool my_auth_failover {
>         type = fail-over
>         home_server = localhost
>  }
>  realm example.com {
>         auth_pool = my_auth_failover
>  }
>  realm LOCAL {
>  }
> radiusd: #### Loading Clients ####
>  client localhost {
>         require_message_authenticator = no
>         secret = "mysecretpass"
>         shortname = "myclient"
>  }
> radiusd: #### Instantiating modules ####
>  instantiate {
>  Module: Linked to module rlm_exec
>  Module: Instantiating exec
>   exec {
>         wait = no
>         input_pairs = "request"
>         shell_escape = yes
>   }
>  Module: Linked to module rlm_expr
>  Module: Instantiating expr
>  Module: Linked to module rlm_expiration
>  Module: Instantiating expiration
>   expiration {
>         reply-message = "Password Has Expired  "
>   }
>  Module: Linked to module rlm_logintime
>  Module: Instantiating logintime
>   logintime {
>         reply-message = "You are calling outside your allowed timespan  "
>         minimum-timeout = 60
>   }
>  }
> radiusd: #### Loading Virtual Servers ####
> server inner-tunnel {
>  modules {
>  Module: Checking authenticate {...} for more modules to load
>  Module: Linked to module rlm_pap
>  Module: Instantiating pap
>   pap {
>         encryption_scheme = "auto"
>         auto_header = no
>   }
>  Module: Linked to module rlm_chap
>  Module: Instantiating chap
>  Module: Linked to module rlm_mschap
>  Module: Instantiating mschap
>   mschap {
>         use_mppe = yes
>         require_encryption = no
>         require_strong = no
>         with_ntdomain_hack = no
>   }
>  Module: Linked to module rlm_unix
>  Module: Instantiating unix
>   unix {
>         radwtmp = "/var/log/radius/radwtmp"
>   }
>  Module: Linked to module rlm_eap
>  Module: Instantiating eap
>   eap {
>         default_eap_type = "ttls"
>         timer_expire = 60
>         ignore_unknown_eap_types = no
>         cisco_accounting_username_bug = no
>         max_sessions = 2048
>   }
>  Module: Linked to sub-module rlm_eap_md5
>  Module: Instantiating eap-md5
>  Module: Linked to sub-module rlm_eap_leap
>  Module: Instantiating eap-leap
>  Module: Linked to sub-module rlm_eap_gtc
>  Module: Instantiating eap-gtc
>    gtc {
>         challenge = "Password: "
>         auth_type = "PAP"
>    }
>  Module: Linked to sub-module rlm_eap_tls
>  Module: Instantiating eap-tls
>    tls {
>         rsa_key_exchange = no
>         dh_key_exchange = yes
>         rsa_key_length = 512
>         dh_key_length = 512
>         verify_depth = 0
>         pem_file_type = yes
>         private_key_file = "/etc/raddb/clearos-certs/key.pem"
>         certificate_file = "/etc/raddb/clearos-certs/cert.pem"
>         CA_file = "/etc/raddb/clearos-certs/ca.pem"
>         dh_file = "/etc/raddb/clearos-certs/dh1024.pem"
>         random_file = "/etc/raddb/clearos-certs/random"
>         fragment_size = 1024
>         include_length = yes
>         check_crl = no
>         cipher_list = "DEFAULT"
>     cache {
>         enable = no
>         lifetime = 24
>         max_entries = 255
>     }
>    }
>  Module: Linked to sub-module rlm_eap_ttls
>  Module: Instantiating eap-ttls
>    ttls {
>         default_eap_type = "md5"
>         copy_request_to_tunnel = no
>         use_tunneled_reply = no
>         virtual_server = "clearos-inner-tunnel"
>         include_length = yes
>    }
>  Module: Linked to sub-module rlm_eap_peap
>  Module: Instantiating eap-peap
>    peap {
>         default_eap_type = "mschapv2"
>         copy_request_to_tunnel = no
>         use_tunneled_reply = no
>         proxy_tunneled_request_as_eap = yes
>         virtual_server = "inner-tunnel"
>    }
>  Module: Linked to sub-module rlm_eap_mschapv2
>  Module: Instantiating eap-mschapv2
>    mschapv2 {
>         with_ntdomain_hack = no
>    }
>  Module: Checking authorize {...} for more modules to load
>  Module: Linked to module rlm_realm
>  Module: Instantiating suffix
>   realm suffix {
>         format = "suffix"
>         delimiter = "@"
>         ignore_default = no
>         ignore_null = no
>   }
>  Module: Linked to module rlm_files
>  Module: Instantiating files
>   files {
>         usersfile = "/etc/raddb/users"
>         acctusersfile = "/etc/raddb/acct_users"
>         preproxy_usersfile = "/etc/raddb/preproxy_users"
>         compat = "no"
>   }
>  Module: Checking session {...} for more modules to load
>  Module: Linked to module rlm_radutmp
>  Module: Instantiating radutmp
>   radutmp {
>         filename = "/var/log/radius/radutmp"
>         username = "%{User-Name}"
>         case_sensitive = yes
>         check_with_nas = yes
>         perm = 384
>         callerid = yes
>   }
>  Module: Checking post-proxy {...} for more modules to load
>  Module: Checking post-auth {...} for more modules to load
>  Module: Linked to module rlm_attr_filter
>  Module: Instantiating attr_filter.access_reject
>   attr_filter attr_filter.access_reject {
>         attrsfile = "/etc/raddb/attrs.access_reject"
>         key = "%{User-Name}"
>   }
>  } # modules
> } # server
> server clearos-inner-tunnel {
>  modules {
>  Module: Checking authenticate {...} for more modules to load
>  Module: Checking authorize {...} for more modules to load
>  Module: Linked to module rlm_ldap
>  Module: Instantiating ldap
>   ldap {
>         server = "localhost"
>         port = 389
>         password = "CnboAg6Wb3lTe75u"
>         identity = "cn=manager,cn=internal,dc=clearos,dc=lan"
>         net_timeout = 5
>         timeout = 20
>         timelimit = 10
>         tls_mode = no
>         start_tls = no
>         tls_require_cert = "allow"
>    tls {
>         start_tls = no
>         require_cert = "allow"
>    }
>         basedn = "dc=clearos,dc=lan"
>         filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
>         base_filter = "(objectclass=radiusprofile)"
>         auto_header = no
>         access_attr_used_for_allow = yes
>         groupname_attribute = "cn"
>         groupmembership_filter = 
> "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"
>         dictionary_mapping = "/etc/raddb/ldap.attrmap"
>         ldap_debug = 0
>         ldap_connections_number = 5
>         compare_check_items = no
>         do_xlat = yes
>         set_auth_type = yes
>   }
> rlm_ldap: Registering ldap_groupcmp for Ldap-Group
> rlm_ldap: Registering ldap_xlat with xlat_name ldap
> rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed 
> in the "authenticate" section.
> rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap
> rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
> rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
> rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
> rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
> rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
> rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
> rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
> rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
> rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
> rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
> rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password
> rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
> rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
> rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
> rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
> rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
> rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
> rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
> rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
> rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
> rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
> rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
> rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
> rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
> rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
> rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
> rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
> rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
> rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
> rlm_ldap: LDAP radiusClass mapped to RADIUS Class
> rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
> rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
> rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
> rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
> rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
> rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
> rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS 
> Framed-AppleTalk-Link
> rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS 
> Framed-AppleTalk-Network
> rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS 
> Framed-AppleTalk-Zone
> rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
> rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
> rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
> rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type
> rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type
> rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS 
> Tunnel-Private-Group-Id
> conns: 0x8eaf548
>  Module: Checking session {...} for more modules to load
>  Module: Checking post-proxy {...} for more modules to load
>  Module: Checking post-auth {...} for more modules to load
>  } # modules
> } # server
> server {
>  modules {
>  Module: Checking authenticate {...} for more modules to load
>  Module: Checking authorize {...} for more modules to load
>  Module: Linked to module rlm_preprocess
>  Module: Instantiating preprocess
>   preprocess {
>         huntgroups = "/etc/raddb/huntgroups"
>         hints = "/etc/raddb/hints"
>         with_ascend_hack = no
>         ascend_channels_per_line = 23
>         with_ntdomain_hack = no
>         with_specialix_jetstream_hack = no
>         with_cisco_vsa_hack = no
>         with_alvarion_vsa_hack = no
>   }
>  Module: Checking preacct {...} for more modules to load
>  Module: Linked to module rlm_acct_unique
>  Module: Instantiating acct_unique
>   acct_unique {
>         key = "User-Name, Acct-Session-Id, NAS-IP-Address, 
> Client-IP-Address, NAS-Port"
>   }
>  Module: Checking accounting {...} for more modules to load
>  Module: Linked to module rlm_detail
>  Module: Instantiating detail
>   detail {
>         detailfile = 
> "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
>         header = "%t"
>         detailperm = 384
>         dirperm = 493
>         locking = no
>         log_packet_header = no
>   }
>  Module: Instantiating attr_filter.accounting_response
>   attr_filter attr_filter.accounting_response {
>         attrsfile = "/etc/raddb/attrs.accounting_response"
>         key = "%{User-Name}"
>   }
>  Module: Checking session {...} for more modules to load
>  Module: Checking post-proxy {...} for more modules to load
>  Module: Checking post-auth {...} for more modules to load
>  } # modules
> } # server
> radiusd: #### Opening IP addresses and Ports ####
> listen {
>         type = "auth"
>         ipaddr = *
>         port = 0
> }
> listen {
>         type = "acct"
>         ipaddr = *
>         port = 0
> }
> listen {
>         type = "control"
>  listen {
>         socket = "/var/run/radiusd/radiusd.sock"
>  }
> }
> Listening on authentication address * port 1812
> Listening on accounting address * port 1813
> Listening on command file /var/run/radiusd/radiusd.sock
> Listening on proxy address * port 1814
> Ready to process requests.
> rad_recv: Access-Request packet from host 127.0.0.1 port 40537, 
> id=123, length=55
>         User-Name = "bob"
>         User-Password = "hello"
>         NAS-IP-Address = 127.0.0.1
>         NAS-Port = 0
> +- entering group authorize {...}
> ++[preprocess] returns ok
> ++[chap] returns noop
> ++[mschap] returns noop
> [suffix] No '@' <mailto:%27@%27> in User-Name = "bob", looking up 
> realm NULL
> [suffix] No such realm "NULL"
> ++[suffix] returns noop
> [eap] No EAP-Message, not doing EAP
> ++[eap] returns noop
> [files] users: Matched entry bob at line 1
> ++[files] returns ok
> [ldap] performing user authorization for bob
> [ldap]  expand: %{Stripped-User-Name} ->
> [ldap]  expand: %{User-Name} -> bob
> [ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=bob)
> [ldap]  expand: dc=clearos,dc=lan -> dc=clearos,dc=lan
> rlm_ldap: ldap_get_conn: Checking Id: 0
> rlm_ldap: ldap_get_conn: Got Id: 0
> rlm_ldap: attempting LDAP reconnection
> rlm_ldap: (re)connect to localhost:389, authentication 0
> rlm_ldap: bind as 
> cn=manager,cn=internal,dc=clearos,dc=lan/CnboAg6Wb3lTe75u to localhost:389
> rlm_ldap: waiting for bind result ...
> rlm_ldap: Bind was successful
> rlm_ldap: performing search in dc=clearos,dc=lan, with filter (uid=bob)
> rlm_ldap: object not found
> [ldap] search failed
> rlm_ldap: ldap_release_conn: Release Id: 0
> ++[ldap] returns notfound
> ++[expiration] returns noop
> ++[logintime] returns noop
> ++[pap] returns updated
> Found Auth-Type = PAP
> +- entering group PAP {...}
> [pap] login attempt with password "hello"
> [pap] Using clear text password "hello"
> [pap] User authenticated successfully
> ++[pap] returns ok
> +- entering group post-auth {...}
> ++[exec] returns noop
> Sending Access-Accept of id 123 to 127.0.0.1 port 40537
> Finished request 0.
> Going to the next request
> Waking up in 4.9 seconds.
> Cleaning up request 0 ID 123 with timestamp +6
> Ready to process requests.
> rad_recv: Access-Request packet from host 127.0.0.1 port 52736, id=80, 
> length=57
>         User-Name = "user1"
>         User-Password = "user1pass"
>         NAS-IP-Address = 127.0.0.1
>         NAS-Port = 0
> +- entering group authorize {...}
> ++[preprocess] returns ok
> ++[chap] returns noop
> ++[mschap] returns noop
> [suffix] No '@' <mailto:%27@%27> in User-Name = "user1", looking up 
> realm NULL
> [suffix] No such realm "NULL"
> ++[suffix] returns noop
> [eap] No EAP-Message, not doing EAP
> ++[eap] returns noop
> rlm_ldap: Entering ldap_groupcmp()
> [files]         expand: dc=clearos,dc=lan -> dc=clearos,dc=lan
> [files]         expand: %{Stripped-User-Name} ->
> [files]         expand: %{User-Name} -> user1
> [files]         expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) 
> -> (uid=user1)
> rlm_ldap: ldap_get_conn: Checking Id: 0
> rlm_ldap: ldap_get_conn: Got Id: 0
> rlm_ldap: performing search in dc=clearos,dc=lan, with filter (uid=user1)
> rlm_ldap: object not found
> rlm_ldap::ldap_groupcmp: search failed
> rlm_ldap: ldap_release_conn: Release Id: 0
> [files] users: Matched entry DEFAULT at line 1
> ++[files] returns ok
> [ldap] performing user authorization for user1
> [ldap]  expand: %{Stripped-User-Name} ->
> [ldap]  expand: %{User-Name} -> user1
> [ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> 
> (uid=user1)
> [ldap]  expand: dc=clearos,dc=lan -> dc=clearos,dc=lan
> rlm_ldap: ldap_get_conn: Checking Id: 0
> rlm_ldap: ldap_get_conn: Got Id: 0
> rlm_ldap: performing search in dc=clearos,dc=lan, with filter (uid=user1)
> rlm_ldap: object not found
> [ldap] search failed
> rlm_ldap: ldap_release_conn: Release Id: 0
> ++[ldap] returns notfound
> ++[expiration] returns noop
> ++[logintime] returns noop
> [pap] Found existing Auth-Type, not changing it.
> ++[pap] returns noop
> Found Auth-Type = Reject
> Auth-Type = Reject, rejecting user
> Failed to authenticate the user.
> Using Post-Auth-Type Reject
> +- entering group REJECT {...}
> [attr_filter.access_reject]     expand: %{User-Name} -> user1
>  attr_filter: Matched entry DEFAULT at line 11
> ++[attr_filter.access_reject] returns updated
> Delaying reject of request 1 for 1 seconds
> Going to the next request
> Waking up in 0.9 seconds.
> Sending delayed reject for request 1
> Sending Access-Reject of id 80 to 127.0.0.1 port 52736
> Waking up in 4.5 seconds.
> ***************************************************
> Hope someone can show some light to this unix illiterate.
> Regards,
> Ricardo
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20110912/b341cce5/attachment.html>


More information about the Freeradius-Users mailing list