ntlm_auth & ldap authorize questions

[Tobias Hachmer]

Hello list,

I set up a testing environment with an virtual Windows Server 2008 R2 
server with Active Directory Role and a virtual freeradius server 
(v2.1.12).
For the authentication I use ntlm_auth (followed instructions on 
http://deployingradius.com/documents/configuration/active_directory.html) 
which works great.
I understand that I cannot authorize using ntlm_auth so I want to set 
up the ldap module for authorization, e.g. perform checks on group 
memberships.


The ldap bind with the builtin Administrator and also the ldap search 
in the basedn for the builtin account Administrator is successful:

Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 42796, id=160, 
length=83
         User-Name = "Administrator"
         User-Password = "abc123!"
         NAS-IP-Address = 127.0.1.1
         NAS-Port = 0
         Message-Authenticator = 0x2f21233db6232800e133f6891b78309d
# Executing section authorize from file 
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "Administrator", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[files] users: Matched entry DEFAULT at line 205
++[files] returns ok
[ldap] performing user authorization for Administrator
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} -> Administrator
[ldap]  expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> 
(cn=Administrator)
[ldap]  expand: cn=Users,dc=test,dc=local -> cn=Users,dc=test,dc=local
   [ldap] ldap_get_conn: Checking Id: 0
   [ldap] ldap_get_conn: Got Id: 0
   [ldap] performing search in cn=Users,dc=test,dc=local, with filter 
(cn=Administrator)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that 
the user is configured correctly?
[ldap] user Administrator authorized to use remote access
   [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = ntlm_auth
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[ntlm_auth]     expand: --username=%{mschap:User-Name} -> 
--username=Administrator
[ntlm_auth]     expand: --password=%{User-Password} -> 
--password=abc123!
Exec-Program output: NT_STATUS_OK: Success (0x0)
Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0)
Exec-Program: returned: 0
++[ntlm_auth] returns ok
# Executing section post-auth from file 
/etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 160 to 127.0.0.1 port 42796
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 1 ID 160 with timestamp +380
Ready to process requests.


My first problem is that I cannot do the ldap bind with any other user 
as the builtin Administrator. I created a new user freeradius in 
cn=Users,dc=test,dc=local where the builtin Administrator also is 
located but the bind fails:

Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 44706, id=162, 
length=83
         User-Name = "Administrator"
         User-Password = "abc123!"
         NAS-IP-Address = 127.0.1.1
         NAS-Port = 0
         Message-Authenticator = 0x6b50ad7469b14cd74c9fcb7c41d93cc1
# Executing section authorize from file 
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "Administrator", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[files] users: Matched entry DEFAULT at line 205
++[files] returns ok
[ldap] performing user authorization for Administrator
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} -> Administrator
[ldap]  expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> 
(cn=Administrator)
[ldap]  expand: cn=Users,dc=test,dc=local -> cn=Users,dc=test,dc=local
   [ldap] ldap_get_conn: Checking Id: 0
   [ldap] ldap_get_conn: Got Id: 0
   [ldap] attempting LDAP reconnection
   [ldap] (re)connect to testwdc.test.local:389, authentication 0
   [ldap] bind as cn=freeradius,cn=Users,dc=test,dc=local/abc234! to 
testwdc.test.local:389
   [ldap] waiting for bind result ...
   [ldap] LDAP login failed: check identity, password settings in ldap 
section of radiusd.conf
   [ldap] (re)connection attempt failed
[ldap] search failed
   [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns fail
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> Administrator
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 162 to 127.0.0.1 port 44706
Waking up in 4.9 seconds.
Cleaning up request 0 ID 162 with timestamp +6
Ready to process requests

Question: Are there any permission requirements for binddn user or has 
anyone a hint why the ldap bind with any other user as builtin 
Administrator fails?


Also the ldap search for any other user as the builtin Administrator 
fails:

Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 54411, id=98, 
length=80
         User-Name = "freeradius"
         User-Password = "abc234!"
         NAS-IP-Address = 127.0.1.1
         NAS-Port = 0
         Message-Authenticator = 0x5158c0c680156b9feda64a7ac17c880e
# Executing section authorize from file 
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "freeradius", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[files] users: Matched entry DEFAULT at line 205
++[files] returns ok
[ldap] performing user authorization for freeradius
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} -> freeradius
[ldap]  expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> 
(cn=freeradius)
[ldap]  expand: cn=Users,dc=test,dc=local -> cn=Users,dc=test,dc=local
   [ldap] ldap_get_conn: Checking Id: 0
   [ldap] ldap_get_conn: Got Id: 0
   [ldap] performing search in cn=Users,dc=test,dc=local, with filter 
(cn=freeradius)
   [ldap] object not found
[ldap] search failed
   [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns notfound
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = ntlm_auth
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[ntlm_auth]     expand: --username=%{mschap:User-Name} -> 
--username=freeradius
[ntlm_auth]     expand: --password=%{User-Password} -> 
--password=abc234!
Exec-Program output: NT_STATUS_OK: Success (0x0)
Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0)
Exec-Program: returned: 0
++[ntlm_auth] returns ok
# Executing section post-auth from file 
/etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 98 to 127.0.0.1 port 54411
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 1 ID 98 with timestamp +32
Ready to process requests.


Thanks in advance for pointing me to the right direction.

Regards,

Tobias Hachmer