LDAP - bind as user - howto?

Matej Žerovnik matej at zunaj.si
Thu Oct 16 21:16:28 CEST 2014


Hey!

I'm having troubles setting authentication over LDAP in 'bind as user' 
mode. I only want to authenticate user against LDAP(ldap bind with 
user/pass provided by the user) and if login is successful, then radius 
returns Access-Accept.
I'm using radius 2.1.12.

In modules/ldap I have the following:
         server = "ldaps.example.com"
         port = "636"
         basedn = "dc=example,dc=com"
         filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
         ldap_connections_number = 5
         timeout = 4
         timelimit = 3
         net_timeout = 1
         password_attribute = userPassword
         set_auth_type = yes

In sites-available/defaults I have:
authorize {
     preprocess
}
authenticate {
         Auth-Type LDAP {
                 ldap
         }
}
The rest of the modules are empty.

In hints file I have:
DEFAULT Ldap-UserDN := "uid=%{User-Name},ou=test,dc=example,dc=com", 
Auth-Type := LDAP

When I try to login, the login fails... In debug log I see the following:
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
[preprocess]   hints: Matched DEFAULT at 36
++[preprocess] returns ok
++[files] returns noop
ERROR: No authenticate method (Auth-Type) found for the request: 
Rejecting the user
Failed to authenticate the user.
Using Post-Auth-Type Reject

I guess it matches the hint, but it doesn't try to bind to ldap.

If I put DEFAULT Ldap-UserDN := 
"uid=testuser,ou=test,dc=example,dc=com", Auth-Type := LDAP in users 
file and uncomment files in authorize section, login is successfu.

How do I make radius use template provided in hints file and pass it on 
to authenticate modul, so it tries to login to ldap?
Is this even the right way of doing it? I didn't find many posts, that 
tried to do that. Everybody usually search ldap for USERDN attribute in 
authorize section with ldap module.

Thanks, Matej

-- 
---
Matej Zerovnik


More information about the Freeradius-Users mailing list