FreeRADIUS + OpenLDAP for Wireless authentication

[Mantas Šiurkus]

On 2013.05.22 21:13, Alan DeKok wrote:
> Mantas Šiurkus wrote:
>> I have configured FreeRADIUS to work with OpenLDAP. Created user in
>> OpenLDAP. Radtest from localhost works perfect. But I can't connect from
>> other devices (android phone, etc..). In logs I get:
>>
>> [ldap] No default NMAS login sequence
>> [ldap] looking for check items in directory...
>> [ldap] looking for reply items in directory...
>> WARNING: No "known good" password was found in LDAP.  Are you sure that
>> the user is configured correctly?
>    If FreeRADIUS can't find the user's password, then one of two things
> is true:
>
> a) you've misconfigured FreeRADIUS to look in the wrong place
>
>    or
>
> b) the user doesn't have a password in LDAP.
>
>> I think it is problem in plain text password or something?
>    The problem is in the error message above.  Why look somewhere else?
> Is the debug log *lying* to you?
>
>> What can I do?
>    Ensure that FreeRADIUS is configured correctly.  Ensure that the
> rlm_ldap configuration is correct.  Ensure that the "known good"
> password is found in ldap.
>
>    Alan DeKok.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thank you for the replay. Sorry I am new in freeradius and openldap.

I uncommented two lines in freeradius/modules/ldap

identity = "cn=admin,dc=my,dc=domain"
password = myldappass

And now freeradius debuging logs changed.
When I am connecting from android phone where - "EAP method : PEAP" and 
"phase 2 authetication: MSCHAPV2"
I got thease logs:

[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
   [ldap] userPassword -> Password-With-Header == "pass123"
[ldap] looking for reply items in directory...
[ldap] user radiusas authorized to use remote access
   [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Failed to decode Password-With-Header = "pass123"
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file 
/etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Creating challenge hash with username: radiusas
[mschap] Told to do MS-CHAPv2 for radiusas with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
         MS-CHAP-Error = "\006E=691 R=1"
         EAP-Message = 0x04060004
         Message-Authenticator = 0x00000000000000000000000000000000


When I put user in freeradius/users than it connect. But via LDAP wont 
connect.

Thank You for help.