LDAP module problem

[Hossein Rafighi]

Much appreciate the advise. I did per your suggestion and all seems okay 
except for ldap binding! This is weird! I use exact the same 
username/password for ldap binding on my radius server 2.x, and couple 
other servers however, on this one I am getting "Invalid credentials"! I 
must admit, it has been few years since I setup freeradius 2.x, and much 
has changed since.

If I enable start_tls I get:
TLS: error: the certificate '/etc/raddb/certs/ccndev4.triumf.ca.crt' 
could not be found in the database - error -5939:No more entries in the 
directory.
TLS: certificate '/etc/raddb/certs/ccndev4.triumf.ca.crt' successfully 
loaded from PEM file.
TLS: no unlocked certificate for certificate 
'E=system at triumf.ca,CN=ccndev4.triumf.ca,OU=Computing 
Services,O=TRIUMF,L=Vancouver,ST=BC,C=CA'.
TLS: certificate [CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US] is not 
valid - error -8172:Peer's certificate issuer has been marked as not 
trusted by the user..
TLS: error: connect - force handshake failure: errno 0 - moznss error -8172
TLS: can't connect: TLS error -8172:Peer's certificate issuer has been 
marked as not trusted by the user..
rlm_ldap (ldap): Could not start TLS: Connect error
rlm_ldap (ldap): Opening connection failed (0)
rlm_ldap (ldap): Removing connection pool
/etc/raddb/mods-enabled/ldap[12]: Instantiation failed for module "ldap"

my certs are self signed and in /certs. The same as freeradius 2 server 
that is happy!

If I set start_tls to no I get:
rlm_ldap: Falling back to build time libldap version info.  Query for 
LDAP_OPT_API_INFO returned: -1
rlm_ldap: libldap vendor: OpenLDAP version: 20439
    accounting {
         reference = "%{tolower:type.%{Acct-Status-Type}}"
    }
    post-auth {
         reference = "."
    }
rlm_ldap (ldap): Initialising connection pool
    pool {
         start = 5
         min = 4
         max = 32
         spare = 3
         uses = 0
         lifetime = 0
         cleanup_interval = 30
         idle_timeout = 60
         retry_delay = 1
         spread = no
    }
rlm_ldap (ldap): Opening additional connection (0)
rlm_ldap (ldap): Connecting to trmail.triumf.ca:389
rlm_ldap (ldap): Could not set random_file: Success
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials
rlm_ldap (ldap): Opening connection failed (0)
rlm_ldap (ldap): Removing connection pool
/etc/raddb/mods-enabled/ldap[12]: Instantiation failed for module "ldap"


Here is the LDAP related entries:
         server = "myldap.triumf.ca"
         port = 389
         identity = "cn=manager,o=triumf"
         password = ****************
         base_dn = "o=triumf"
         edir_autz = yes
         access_attribute = "uid"
         filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

Everything else is default! Did I miss something else here?
Many thanks for all your advise,
Hossein


On 10/7/2015 11:35 AM, Alan Buxey wrote:
> You've appear to have uncommented documentation. ..read what it says. 
> You need to put that sort of stuff into the virtual server config (ie 
> in the authorize section of the inner tunnel) as the online 
> documentation is telling you :)
>
> alan 

-- 
   _____  _____   _____  _   _  _   _  ____ Hossein Rafighi
  |_   _||  _  \ |_   _|| | | || \_/ ||  __|TRIUMF, 4004 Wesbrook Mall
    | |  | |_|  )  | |  | | | ||     || |__ Vancouver BC, Canada, V6T 2A3
    | |  |  _  /   | |  | \_/ || \_/ ||  __|Voice: (604) 222-1047
    | |  | | \ \  _| |_ |     || | | || |   Fax:   (604) 222-1074
    |_|  |_|  \_\|_____| \___/ |_| |_||_|   Website: http://www.triumf.ca