FreeRADIUS and Active Directory: Access-Reject (RHEL/CentOS 8)

[Alan DeKok]

On Jun 1, 2022, at 6:21 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users at lists.freeradius.org> wrote:
> Does anyone have FreeRADIUS on RHEL/CentOS 8 working with LDAP/Active Directory as its back end ?

  Yes, lots.

>    My Microsoft SME says AD will never hand back a password.

  Very true.

>    How do I get RADIUS to hand the password to AD  ?

  http://deployingradius.com

  There has been a FreeRADIUS / AD "howto" on my web site for 15+ years.  A google search for "freeradius active directory" also gets the FreeRADIUS wiki, which works, too.

  What is annoying is the endless third-party sites which basically rip off my documentation, explain it badly, and get things wrong.

>    (0) Received Access-Request Id 70 from 127.0.0.1:53801 to 127.0.0.1:1812 length 74
> ...
>    (0)     [preprocess] = ok
>    (0)     [chap] = noop
>    (0)     [mschap] = noop
>    (0)     [digest] = noop
>    (0) suffix: Checking for suffix after "@"
>    (0) suffix: No '@' in User-Name = "demo", looking up realm NULL
>    (0) suffix: No such realm "NULL"
>    (0)     [suffix] = noop
>    (0) eap: No EAP-Message, not doing EAP
>    (0)     [eap] = noop
>    (0)     [files] = noop
>    rlm_ldap (ldap): Reserved connection (0)
>    (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})
>    (0) ldap:    --> (sAMAccountName=demo)
>    (0) ldap: Performing search in "OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" with filter "(sAMAccountName=demo)", scope "sub"
>    (0) ldap: Waiting for search result...
>    (0) ldap: User object found at DN "CN=Demo,OU=USERGROUP,OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4"
>    (0) ldap: Processing user attributes
>    (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
>    (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)

  Exactly.  It's Active Directory.  That's why we added the debug message.
> 
>    (0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type
>    (0) pap: WARNING: Authentication will fail unless a "known good" password is available
>    (0)     [pap] = noop
>    (0)   } # authorize = ok
>    (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
>    (0) Failed to authenticate the user

  This exact same question came up yesterday in another thread.

  The default "mods-available/ldap" configuration file has documentation which says how to fix this.  You need to set "Auth-Type LDAP", along with a few other things.  See the comments in mods-available/ldap

  Alan DeKok.