guide on configuring freeradius 3 LDAP

[Douglas C Ward]

I’m still having issues. I went ahead and completely blew away my whole FreeRADIUS install, and re-installed it. I went through the whole “Getting Started” successfully again, connected successfully using RADIUS from an iOS device using the testing / password user in the local database, per the getting started example.

Then I went and edited the ‘ldap’ module, adding only the following:

server = (my LDAP server hostname)
base_dn = (my server’s base DN)
identity = (using my version of the example  'cn=admin,dc=example,dc=org’)
password = (mypass)

after successfully restarting the debug server with no errors, I did a radtest for a known good user, and got…

##########################################

Ready to process requests
(0) Received Access-Request Id 153 from 127.0.0.1:62899 to 127.0.0.1:1812 length 111
(0)   User-Name = "dward at iacollaborative.com"
(0)   User-Password = "[EDITED OUT]"
(0)   NAS-IP-Address = 172.16.172.19
(0)   NAS-Port = 0
(0)   Message-Authenticator = 0x826d986e5c3996e96136f858b88b42e6
(0) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.15/etc/raddb/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "iacollaborative.com" for User-Name = "dward at iacollaborative.com"
(0) suffix: No such realm "iacollaborative.com"
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type
(0) pap: WARNING: Authentication will fail unless a "known good" password is available
(0)     [pap] = noop
(0)   } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.15/etc/raddb/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> dward at iacollaborative.com
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 153 from 127.0.0.1:1812 to 127.0.0.1:62899 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 153 with timestamp +10
Ready to process requests

##########################################

So I’m not sure what else I should be doing.

—Douglas

> On Jan 18, 2018, at 3:31 PM, Douglas C Ward <douglas at ugutech.com> wrote:
> 
> and that “authorize” section is in my ‘default’ file I believe. And that I haven’t made any changes to. And the “ldap” section has the “-“ in front of it, as the radiusd.conf file recommends...
> 
>        #
>        #  The ldap module reads passwords from the LDAP database.
>        -ldap
> 
> … 
> 
> —Douglas
> 
>> On Jan 18, 2018, at 3:21 PM, Alan Buxey <alan.buxey at gmail.com> wrote:
>> 
>> not seeing any ldap action in your authorize section yet...
>> 
>> alan
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
> 
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html