I have a problem in(my radclient) getting authenticated by RADIUS Server using LDAP
module.I have installed Openldap in my local machine.
Let me put the info about my files that I'm using.I'm very sorry if u people feel that
this much info is not necessary to figure out problem...
Say my slapd.conf is the following:
--<slapd.conf>
include /usr/local/etc/openldap/schema/core.schema
pidfile /usr/local/var/slapd.pid
argsfile /usr/local/var/slapd.args
database bdb
directory /usr/local/var/openldap-data
index objectClass eq
access to attribute=userPassword
by dn="cn=manager" write
by anonymous auth
by self write
by * none
access to *
by dn="cn=manager" write
by * read
access to dn=".*,ou=Roaming,o=morsnet"
by dn="cn=manager" write
by dnattr=owner write
suffix "o=icope"
rootdn "cn=manager,o=icope"
rootpw coin
--</slapd.conf>
and then I run LDAP service by using command
$ slapd -4 -d 2
Then I have added an user with the command ldapadd say
$ ldapadd -x -D "cn=manager,o=icope" -W -f base.ldif
It is successfully done.
where base.ldif is
--<base.ldif>
dn: o=icope
objectClass: organization
o: icope
dn: cn=manager,o=icope
objectclass: organizationalRole
cn: manager
dn: cn=vishal,o=icope
sn: vishal
cn: vishal
userPassword: vishal
objectClass: person
telephoneNumber: 5716909
description: He is a employee
--</base.ldif>
For verifying I did ldapsearch
$ ldapsearch -x -b 'o=icope' '(objectclass=*)'
# LDAPv3
# base <o=icope> with scope sub
# filter: (objectclass=*)
# requesting: ALL
#
# icope
dn: o=icope
objectClass: organization
o: icope
# manager, icope
dn: cn=manager,o=icope
objectClass: organizationalRole
cn: manager
# vishal, icope
dn: cn=vishal,o=icope
sn: vishal
cn: vishal
objectClass: person
telephoneNumber: 5716909
description: He is a employee at icope
# search result
search: 2
result: 0 Success
# numResponses: 4
# numEntries: 3
Now let me put up my radiusd.conf(I have modified mine according to the posting given
in http://lists.cistron.nl/pipermail/freeradius-users/2001-August/001646.html)
--<radiusd.conf>
modules{
ldap{
server = "10.0.1.180"
#server = localhost ->Tried this also
#identity = "cn=manager ,o=icope"
#password = coin
basedn = "o=icope"
filter = "uid=%u"
dictionary_mapping = ${raddbdir}/ldap.attrmap
timeout = 4
timelimit = 3
net_timeout = 1
ldap_debug = 0x0000
}
}
instantiate{
expr
}
authorize{
#preprocess ->I tried with and without commneting this
ldap
}
authenticate{
Auth-Type LDAP{
ldap
}
}
--</radiusd.conf>
In the case of users file
--<users file>
DEFAULT Auth-Type :=LDAP
Fall-Through=1
--</users file>
Even I tried out putting this entry in LDAP attribute map file(ldap.attrmap)
--<ldap.attrmap>
CheckItem User-Name cn
CheckItem User-Password userPassword
--</ldap.attrmap>
After all these settings when I try to run radclient say
$ echo "User-Name = \"vishal\", Password = \"vishal\"" | radclient -x -s 10.0.1.180
auth testing123
(The result in the client terminal is)
Sending Access-Request of id 95 to 10.0.1.180:1812
User-Name = "vishal"
Password = "vishal"
Re-sending Access-Request of id 95 to 10.0.1.180:1812
User-Name = "vishal"
Password = ";n\364C\212i\376f\007\367\355)\246\317\371\335"
rad_recv: Access-Reject packet from host 10.0.1.180:1812, id=95, length=20
Total approved auths: 0
Total denied auths: 1
Meanwhile in the server end(I'm adding all the log from server end)
$ radiusd -x
Starting - reading configuration files ...
Using deprecated naslist file. Support for this will go away soon.
Using deprecated clients file. Support for this will go away soon.
Using deprecated realms file. Support for this will go away soon.
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded LDAP
conns: (nil)
rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP cn mapped to RADIUS User-Name
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP userPassword mapped to RADIUS User-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
conns: 0x80b0c00
Module: Instantiated ldap (ldap)
Module: Loaded preprocess
Module: Instantiated preprocess (preprocess)
Module: Loaded files
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
Module: Instantiated detail (detail)
Module: Loaded radutmp
Module: Instantiated radutmp (radutmp)
Initializing the thread pool...
Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp.
Ready to process requests.
rad_recv: Access-Request packet from host 10.0.1.180:1088, id=104, length=46
User-Name = "vishal"
Password = "vishal"
rlm_ldap: - authorize
rlm_ldap: performing user authorization for vishal
ldap_get_conn: Got Id: 0
rlm_ldap: (re)connect to 10.0.1.180:389, authentication 0
rlm_ldap: bind as / to 10.0.1.180:389
rlm_ldap: waiting for bind result ...
rlm_ldap: object not found or got ambiguous search result
rlm_ldap: search failed
ldap_release_conn: Release Id: 0
rad_recv: Access-Request packet from host 10.0.1.180:1088, id=104, length=46
Sending Access-Reject of id 104 to 10.0.1.180:1088
How to look about this probs.As a newbie to RADIUS Server configuration, I'll
appreciate if somebody can help me out in figuring this problem.
Thanx in advance
-Vishal
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
