Help with Freeradius + OpenLDAP/Samba + 802.1x WLan auth for Windows

[Albrecht Dreß]

Hi,

sorry if my question is really dumb; I'm new to the list...


- Win XP WLan clients authenticate at an WLan access point with 802.1x;
- the access points talks to the Freeradius server;

- every user who can authenticate properly shall get access.



rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to kolab.lios-koeln.de:389, authentication 0
rlm_ldap: bind as [...] to [...]:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful

rlm_ldap: Added password [...] in check items
rlm_ldap: No default NMAS login sequence
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding userPassword as User-Password == "[...]"
rlm_ldap: Adding sambaNTPassword as NT-Password == [...]
rlm_ldap: looking for reply items in directory...
rlm_ldap: user my-domain\username authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
  modcall[authorize]: module "ldap" returns ok for request 0
rlm_pap: Normalizing NT-Password from hex encoding
rlm_pap: Found existing Auth-Type, not changing it.
  modcall[authorize]: module "pap" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: Identity does not match User-Name, setting from EAP Identity.
  rlm_eap: Failed in handler
  modcall[authenticate]: module "eap" returns invalid for request 0
modcall: leaving group authenticate (returns invalid) for request 0
auth: Failed to validate the user.



Thanks in advance, Albrecht.

I run Freeradius 1.1.7 on a Ubuntu 8.04 LTS/x86_64 box, and want to have the following: - the user database is in OpenLDAP with the Samba schema, which Freeradius shall check; I am now at a point where Freeradius picks up the requests and authorises the user against ldap, but then eap authentication fails: rlm_ldap: performing search in [...], with filter (&(objectClass=inetOrgPerson)(uid=username)) Any idea what the eap error means (I do *not* have 'with_ntdomain_hack' enabled)? Does anyone have a working example configuration for the setup above (s)he could share?

pgpNq9K6vZiGy.pgp
Description: PGP signature

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html