Authentification Problem with Cisco AP, freeradius and LDAP

2012-10-11 Thread Florian Arenz
Hello,

i have got a realy annoing authentification problem and i would be glad if
you could help me.

I use a Cisco Aironet 1130ag Access Point, the radius-server is a Debian
Squeeze (6.0.5) and i installed FreeRadius Version 2.1.10 from the packet
sources.


After i made some changes to the /etc/freeradius/modules/ldap to let my
radius know where the LDAP is and some other things it looks like this:

--  /etc/freeradius/modules/ldap
ldap {

server  = 172.26.100.1
identity= uid=binduser,cn=users,ou=
Infrastruktur,dc=tarent,dc=de
password= 
basedn  = dc=tarent,dc=de
filter  = (uid=%{%{Stripped-User-Name}:-%{User-Name}})
base_filter = (objectclass=posixAccount)

groupname_attribute = cn

  # groupmembership_filter  =
(|((objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))((objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))
groupmembership_filter  =
((objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))

  # groupmembership_attribute   = radiusGroupName
groupmembership_attribute   = WLAN

  # compare_check_items = yes
  # do_xlat = yes
  # access_attr_used_for_allow  = yes

dictionary_mapping = /etc/freeradius/ldap.attrmap
password_attribute = CleartextPassword
set_auth_type  = yes
 }

when i start the freeradius with freeradius -X this is the output i get:

FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 11
2012 at 17:06:46
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/opendirectory
including configuration file /etc/freeradius/modules/dynamic_clients
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/detail
including configuration file
/etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/sql_log
including configuration 

Re: Authentification Problem with Cisco AP, freeradius and LDAP

2012-10-11 Thread Alan Buxey
1 there is no such word as authentification, its just 'authentication'

2 your client is trying to do EAP-TLS

3 check FreeRADIUS compatability matrix because when you do use eg PEAP (and 
have the CA cert on the client, the MSCHAPv2 will only work with passwords from 
LDAP in certain formats


alan

--
This smartphone uses free WiFi around the world with eduroam, now that's what I 
call smart.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html