----Original Message Follows---- From: "Tony Sciortino" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: <[EMAIL PROTECTED]> Subject: Freeradius using leap and ldap Date: Thu, 1 Jul 2004 00:24:14 -0400
I am very close to getting freeradius to work with leap and ldap but I can not seem to close the deal.
Here is the error I get in the radius.log
Thu Jul 1 00:04:04 2004 : Auth: Login OK: [sysams3/<no User-Password attribute>] (from client 9150 port 432 cli 0002.b3c5.a18c)
Thu Jul 1 00:04:04 2004 : Info: rlm_eap_leap: No User-Password or NT-Password configured for this user
Thu Jul 1 00:04:04 2004 : Auth: Login incorrect: [sysams3/<no User-Password attribute>] (from client 9150 port 432 cli 0002.b3c5.a18c)
So first I am logging in ok, but then I get a login incorrect. So here is the server debug with -x
Starting - reading configuration files ...
Using deprecated naslist file. Support for this will go away soon.
Using deprecated clients file. Support for this will go away soon.
Using deprecated realms file. Support for this will go away soon.
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded eap
rlm_eap: Loaded and initialized the type md5
rlm_eap: Loaded and initialized the type leap
Module: Instantiated eap (eap)
Module: Loaded preprocess
Module: Instantiated preprocess (preprocess)
Module: Loaded files
Module: Instantiated files (files)
Module: Loaded LDAP
conns: (nil)
rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP racfPassword mapped to RADIUS User-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
conns: 0x8105ee0
Module: Instantiated ldap (ldap)
Module: Loaded realm
Module: Instantiated realm (suffix)
Module: Loaded Acct-Unique-Session-Id
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
Module: Instantiated detail (detail)
Module: Loaded radutmp
Module: Instantiated radutmp (radutmp)
Initializing the thread pool...
Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp.
Ready to process requests.
rad_recv: Access-Request packet from host 10.31.131.3:21667, id=169, length=132
User-Name = "sysams3"
Framed-MTU = 1400
Called-Station-Id = "0007.50d6.226d"
Calling-Station-Id = "0002.b3c5.a18c"
Message-Authenticator = 0xa0f0e6d1ab955cf3396016f600e06720
EAP-Message = 0x0201000c01737973616d7333
NAS-Port-Type = Wireless-802.11
NAS-Port = 455
Service-Type = Framed-User
NAS-IP-Address = 10.31.131.3
NAS-Identifier = "PTXDEMO"
rlm_ldap: - authorize
rlm_ldap: performing user authorization for sysams3
ldap_get_conn: Got Id: 0
rlm_ldap: (re)connect to sy29.s390.riteaid.com:389, authentication 0
rlm_ldap: bind as racfid=admin,profiletype=USER,dc=racf,o=riteaid.com/mypass to sy29.s390.riteaid.com:389
rlm_ldap: waiting for bind result ...
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user sysams3 authorized to use remote access
ldap_release_conn: Release Id: 0
Login OK: [sysams3/<no User-Password attribute>] (from client 9150 port 455 cli 0002.b3c5.a18c)
Sending Access-Challenge of id 169 to 10.31.131.3:21667
EAP-Message = 0x0102001711010008414c3c28384d0c23737973616d7333
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xdc61b23364d449ded554a5544c980884338fe340475316e37f128ab9f3eb50a95bc6355c
rad_recv: Access-Request packet from host 10.31.131.3:21667, id=170, length=197
User-Name = "sysams3"
Framed-MTU = 1400
Called-Station-Id = "0007.50d6.226d"
Calling-Station-Id = "0002.b3c5.a18c"
Message-Authenticator = 0x16e8f239ebe2cf3492c757abd7693dfa
EAP-Message = 0x02020027110100187def8e93c865f41d2a0be011f686dfd9b90f515ea77c437e737973616d7333
NAS-Port-Type = Wireless-802.11
NAS-Port = 455
State = 0xdc61b23364d449ded554a5544c980884338fe340475316e37f128ab9f3eb50a95bc6355c
Service-Type = Framed-User
NAS-IP-Address = 10.31.131.3
NAS-Identifier = "PTXDEMO"
rlm_ldap: - authorize
rlm_ldap: performing user authorization for sysams3
ldap_get_conn: Got Id: 0
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user sysams3 authorized to use remote access
ldap_release_conn: Release Id: 0
rlm_eap_leap: No User-Password or NT-Password configured for this user
Login incorrect: [sysams3/<no User-Password attribute>] (from client 9150 port 455 cli 0002.b3c5.a18c)
Sending Access-Reject of id 170 to 10.31.131.3:21667
EAP-Message = 0x04020004
Message-Authenticator = 0x00000000000000000000000000000000
So in one instance, I get user authorized for remote access via ldap, but still EAP is not letting me in.
Now I know the password must be getting from the client to the ldap server ok because I get authorized for remote access. What is the problem with eap/leap
I have been looking and trying everything for a couple days and I am stuck.
Tony
Paul Bender wrote:
From the log, it appears that the LDAP server is returning neither acleartext password (User-Password) nor an NT password (NT-Password).
From the log, it appears that you map racfPassword to User-Password and
ntPassword to NT-Password. Do your user have either of these in LDAP? Does the user that you are binding as have read access to these attributes? What does your LDAP log show?
Tony Sciortino writes:
In my LDAP server there is an attribute called racfPassword. Do I have my mapping incorrect?
For sure I have no NT-Password.
I am sure the user I am binding to LDAP with has the authorization to perform the password read because I have other programs written in Perl, PHP and PAM that bind to the same LDAP server and perform a user validation.
I still don't understand the first I get a Login OK followed by Login incorrect.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
