Problem with two ldap connections

[Jörn Volkhausen]

Just for information of other people who have the same problem.

Issue:

The two ldap configurations are interacting in an undocumented way.

Twe configuration of the first module is touching the second module
configuration and instance.

Solution:

For me it helped to just define the basedn and filter in one of the two
ldap configurations.

The other configuration worked also, because i use them only in pair
with xlat. There is the possibility to define another dn and filter.


I dont know, but could it be that this is not desired operating?


Thanks and hope it helps

Jörn Volkhausen


Am 14.03.2017 um 07:56 schrieb Jörn Volkhausen:
> Hello at all
>
> i have a small problem an dhope anyone can help me.
> First my configuration and the debug output:
>
> --- sites-available/radius-staging --- (is also linked in sites-enabled)
> authorize {
>     if ("%{User-Name}" =~ /^(.*)#(.*)@domain.de$/) {
>                 update request {
>                         Group-Name := "%{1}"
>                         Stripped-User-Name := "%{2}"
>                 }
>         }
>         else {
>                 reject
>         }
>         #"%{exec:/usr/bin/printenv}"
>         ldap-kap-costumertype
>         if
> ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}"
> == unmanaged) {
>                 update control {
>                         Proxy-to-Realm := unmanagedCostumers
>                 }
>         #       updated
>         }
>         else {
>                 ldap-kap-staging
>         #       updated
>         }
> }
>
> authenticate {
>     Auth-Type PAP {
>                 pap
>     }
>     Auth-Type LDAP {
>                 ldap-kap-staging
>     }
> }
>    
> --- modules/ldap-kap-staging ---
> ldap ldap-kap-staging {
>     server := "test"
>         identity := "cn=radiusbinduser,ou=admins,dc=domain,dc=de"
>         password := "XXXXXXX"
>         basedn := "ou=%{Group-Name},dc=domain,dc=de"
>         filter := "(&(uid=%{Stripped-User-Name})(userEnabled=true))"
>
>     dictionary_mapping = ${confdir}/ldap.attrmap
>     set_auth_type = yes
> }
>
> --- modules/ldap-kap-costumertype ---
> ldap ldap-kap-costumertype {
>     server := "test"
>         identity := "cn=radiusbinduser,ou=admins,dc=domain,dc=de"
>         password := "XXXXX"
>         basedn := "dc=domain,dc=de"
>         filter := "ou=%{Group-Name}"
>
>     dictionary_mapping = ${confdir}/ldap.attrmap
>     set_auth_type = no
> }
>
> --- debug output from freeradius ---
> Ready to process requests.
> rad_recv: Access-Request packet from host 10.10.20.100 port 55835, id=1,
> length=131
>     User-Name = "rplus.dt#test at domain.de"
>     Acct-Session-Id = "1489473128K1snz"
>     NAS-IP-Address = 127.0.0.1
>     NAS-Identifier = "Localhost"
>     NAS-Port = 0
>     Calling-Station-Id = "1115551212"
>     User-Password = "testpass"
>     Message-Authenticator = 0xb33a7beab35041d5b1c179deef4d6376
> server radius-staging {
> # Executing section authorize from file
> /etc/freeradius/sites-enabled/radius-staging
> +group authorize {
> ++? if ("%{User-Name}" =~ /^(.*)#(.*)@domain.de$/)
>     expand: %{User-Name} -> rplus.dt#test at domain.de
> ? Evaluating ("%{User-Name}" =~ /^(.*)#(.*)@domain.de$/) -> TRUE
> ++? if ("%{User-Name}" =~ /^(.*)#(.*)@domain.de$/) -> TRUE
> ++if ("%{User-Name}" =~ /^(.*)#(.*)@domain.de$/) {
> +++update request {
>     expand: %{1} -> domain.dt
>     expand: %{2} -> test
> +++} # update request = noop
> ++} # if ("%{User-Name}" =~ /^(.*)#(.*)@domain.de$/) = noop
> ++ ... skipping else for request 0: Preceding "if" was taken
> [ldap-kap-costumertype] performing user authorization for test
> [ldap-kap-costumertype]     expand: ou=%{Group-Name} -> ou=rplus.dt
> [ldap-kap-costumertype]     expand: dc=domain,dc=de -> dc=domain,dc=de
>   [ldap-kap-costumertype] ldap_get_conn: Checking Id: 0
>   [ldap-kap-costumertype] ldap_get_conn: Got Id: 0
>   [ldap-kap-costumertype] attempting LDAP reconnection
>   [ldap-kap-costumertype] (re)connect to test:636, authentication 0
>   [ldap-kap-costumertype] setting TLS mode to 1
>   [ldap-kap-costumertype] bind as
> cn=radiusbinduser,ou=admins,dc=domain,dc=de/XXXXX to test:636
>   [ldap-kap-costumertype] waiting for bind result ...
>   [ldap-kap-costumertype] Bind was successful
>   [ldap-kap-costumertype] performing search in dc=domain,dc=de, with
> filter ou=rplus.dt
> [ldap-kap-costumertype] No default NMAS login sequence
> [ldap-kap-costumertype] looking for check items in directory...
> [ldap-kap-costumertype] looking for reply items in directory...
> WARNING: No "known good" password was found in LDAP.  Are you sure that
> the user is configured correctly?
>   [ldap-kap-costumertype] ldap_release_conn: Release Id: 0
> ++[ldap-kap-costumertype] = ok
> ++? if
> ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}"
> == unmanaged)
>   [ldap-kap-costumertype] - ldap_xlat
>     expand:
> ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name} ->
> ldap:///dc=domain,dc=de?businessCategory?one?ou=rplus.dt
>   [ldap-kap-costumertype] ldap_get_conn: Checking Id: 0
>   [ldap-kap-costumertype] ldap_get_conn: Got Id: 0
>   [ldap-kap-costumertype] performing search in dc=domain,dc=de, with
> filter ou=rplus.dt
>   [ldap-kap-costumertype] Adding attribute businessCategory, value: managed
>   [ldap-kap-costumertype] ldap_release_conn: Release Id: 0
>   [ldap-kap-costumertype] - ldap_xlat end
>     expand:
> %{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}
> -> managed
> ? Evaluating
> ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}"
> == unmanaged) -> FALSE
> ++? if
> ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}"
> == unmanaged) -> FALSE
> ++else else {
> [ldap-kap-staging] performing user authorization for test
> [ldap-kap-staging]     expand:
> (&(uid=%{Stripped-User-Name})(userEnabled=true)) ->
> (&(uid=test)(userEnabled=true))     
> <---------------------------------------
> [ldap-kap-staging]     expand: ou=%{Group-Name},dc=domain,dc=de ->
> ou=rplus.dt,dc=domain,dc=de    <---------------------------------------
>   [ldap-kap-staging] ldap_get_conn: Checking Id: 0
>   [ldap-kap-staging] ldap_get_conn: Got Id: 0
>   [ldap-kap-staging] attempting LDAP reconnection
>   [ldap-kap-staging] (re)connect to test:636, authentication 0
>   [ldap-kap-staging] setting TLS mode to 1
>   [ldap-kap-staging] bind as
> cn=radiusbinduser,ou=admins,dc=domain,dc=de/XXXXX to test:636
>   [ldap-kap-staging] waiting for bind result ...
>   [ldap-kap-staging] Bind was successful
>   [ldap-kap-staging] performing search in ou=rplus.dt,dc=domain,dc=de,
> with filter (&(uid=test)(userEnabled=true))
> [ldap-kap-staging] No default NMAS login sequence
> [ldap-kap-staging] looking for check items in directory...
>   [ldap-kap-staging] userPassword -> Password-With-Header ==
> "{SSHA}ac2cE0LcZb04Hr9mGf5RIvfeoDlDkT5BaEB4tw=="
> [ldap-kap-staging] looking for reply items in directory...
> [ldap-kap-staging] Setting Auth-Type = LDAP
>   [ldap-kap-staging] ldap_release_conn: Release Id: 0
> +++[ldap-kap-staging] = ok
> ++} # else else = ok
> +} # group authorize = ok
> Found Auth-Type = LDAP
> # Executing group from file /etc/freeradius/sites-enabled/radius-staging
> +group LDAP {
> [ldap-kap-staging] login attempt by "test" with password "testpass"
> [ldap-kap-staging] user DN: ou=rplus.dt,dc=domain,dc=de       
> <---------------------------------------
>   [ldap-kap-staging] (re)connect to test:636, authentication 1
>   [ldap-kap-staging] setting TLS mode to 1
>   [ldap-kap-staging] bind as ou=rplus.dt,dc=telekom,dc=de/testpass to
> test:636 <---------------------------------------
>   [ldap-kap-staging] waiting for bind result ...
>   [ldap-kap-staging] Bind failed with invalid credentials    
> ++[ldap-kap-staging] = reject
> +} # group LDAP = reject
> Failed to authenticate the user.
> } # server radius-staging
> Using Post-Auth-Type Reject
> # Executing group from file /etc/freeradius/sites-enabled/radius-staging
> +group REJECT {
> [attr_filter.access_reject]     expand: %{User-Name} ->
> rplus.dt#test at domain.de
> attr_filter: Matched entry DEFAULT at line 11
> ++[attr_filter.access_reject] = updated
> +} # group REJECT = updated
> Delaying reject of request 0 for 1 seconds
>
>
> Can anyone explain me why freeradius use two different userdn's for the
> same ldap configuration [ldap-kap-staging]?
> That he is authorizing the user is good, but why is freeradius using the
> wrong dn at the authenticate stage for the same ldapconfig?
>
> Thank you very much
> Jörn Volkhausen
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html