Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So here's the situation. I want to be able to use my LDAP credentials to log into this switch. Since there is no support for LDAP on the switch itself, I figured that FreeRADIUS has an LDAP module, and that I could use FreeRADIUS as a sort of "bridge".

Here's the output from radiusd:

rad_recv: Access-Request packet from host 10.10.10.249 port 49155, id=0, length=76 
User-Name = "rdraga"
User-Password = "XXXXXXXXXXXX"
Cisco-AVPair = "shell:priv-lvl=1"
NAS-IP-Address = 10.10.10.249
+- entering group authorize {...}
++[suffix] No '@' in User-Name = "rdraga", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns notfound
rlm_ldap: Entering ldap_groupcmp()
    [files]     expand: dc=decisioningsolutions,dc=com -> dc=decisioningsolutions,dc=com
    [files]     expand: (uid=%{User-Name}}) -> (uid=rdraga})
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to ldap.decisioningsolutions.com:389, authentication 0
rlm_ldap: bind as cn=radius_user,ou=People,dc=decisioningsolutions,dc=com/radius to ldap.decisioningsolutions.com:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in dc=decisioningsolutions,dc=com, with filter (uid=rdraga})
rlm_ldap: object not found
rlm_ldap::ldap_groupcmp: search failed
rlm_ldap: ldap_release_conn: Release Id: 0
rlm_ldap: Entering ldap_groupcmp()
    [files]     expand: dc=decisioningsolutions,dc=com -> dc=decisioningsolutions,dc=com
    [files]     expand: (uid=%{User-Name}}) -> (uid=rdraga})
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=decisioningsolutions,dc=com, with filter (uid=rdraga})
rlm_ldap: object not found
rlm_ldap::ldap_groupcmp: search failed
rlm_ldap: ldap_release_conn: Release Id: 0
    [files] users: Matched entry DEFAULT at line 208
++[files] returns ok
[ldap] performing user authorization for rdraga
[ldap]  expand: (uid=%{User-Name}}) -> (uid=rdraga})
[ldap]  expand: dc=decisioningsolutions,dc=com -> dc=decisioningsolutions,dc=com
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=decisioningsolutions,dc=com, with filter (uid=rdraga})
rlm_ldap: object not found
[ldap] search failed
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns notfound
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = Reject
Auth-Type = Reject, rejecting user
  Failed to authenticate the user.
    expand: Host %n -> Host 10.10.10.249
Login incorrect (rlm_ldap: User not found): [rdraga/<redacted>] (from client office port 0) Host 10.10.10.249
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> rdraga
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 0 to 10.10.10.249 port 49155
Waking up in 4.9 seconds.
Cleaning up request 0 ID 0 with timestamp +19
Ready to process requests.

Also, here's my /etc/raddb/modules/ldap file:

ldap {
         server = "ldap.decisioningsolutions.com"
         identity = "cn=radius_user,ou=People,dc=decisioningsolutions,dc=com"
         password = "radius"
         basedn = "dc=decisioningsolutions,dc=com"
 #       filter = "(&(objectclass=user)(objectcategory=user)(userPrincipalName=%{%{Stripped-User-Name}:-%{User-Name}}*))"
 #       filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
 #       filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})"
         filter = "(uid=%{User-Name})"
 #       filter = "(cn=%{User-Name})"
         groupmembership_attribute = "memberOf"
         ldap_connections_number = 5
         timeout = 4
         timelimit = 3
         net_timeout = 1

        tls {
                 start_tls = no

        }

        dictionary_mapping = ${confdir}/ldap.attrmap
        edir_account_policy_check = no

        chase_referrals = yes
        rebind = yes
 }
share|improve this question
add comment

1 Answer

Your problem is that the uid you're specifying isn't being found in the LDAP - do you know the DN of the entry in the LDAP you're after?

rlm_ldap: performing search in dc=decisioningsolutions,dc=com, with filter (uid=rdraga})
rlm_ldap: object not found
[ldap] search failed

It might not be matching due to the extra } on the end of your username - it looks like your radiusd output is from a different run than the modules/ldap config file as it's trying to expand your username expression incorrectly:

rlm_ldap: Entering ldap_groupcmp()
[files] expand: dc=decisioningsolutions,dc=com -> dc=decisioningsolutions,dc=com
[files] expand: (uid=%{User-Name}}) -> (uid=rdraga})

share|improve this answer
    
Actually I caught that } typo early on...got rid of it and still didn't solve the problem. And the FULL DN should be cn=Ryan Draga,ou=People,dc=decisioningsolutions,dc=com –  TuxOtaku Dec 15 '11 at 20:02
    
What do you get if you run the same search from the command line with ldapsearch (does the bind user have permission to get to the right parts of the LDAP)? eg: ldapsearch -h ldap.decisioningsolutions.com -x -D cn=radius_user,ou=People,dc=decisioningsolutions,dc=com -b dc=decisioningsolutions,dc=com -w <bind password> uid=rdraga –  James Yale Dec 16 '11 at 9:23
    
[root@ldap ~]# ldapsearch -h ldap.decisioningsolutions.com -x -D cn=radius_user,ou=People,dc=decisioningsolutions,dc=com -b dc=decisioningsolutions,dc=com -w XXXXXX uid=rdraga version: 1 dn: cn=Ryan Draga,ou=People,dc=decisioningsolutions,dc=com givenName: Ryan sn: Draga cn: Ryan Draga uid: rdraga uidNumber: 1025 gidNumber: 1001 homeDirectory: /home/users/rdraga loginShell: /bin/sh objectClass: inetOrgPerson objectClass: posixAccount userPassword: {MD5}XXXXXXXXXXXXXXX –  TuxOtaku Dec 16 '11 at 14:42
    
Looks like it works - can you post an updated debug output from radiusd ? –  James Yale Dec 16 '11 at 17:18
    
pastebin.com/7B7B2PzN –  TuxOtaku Dec 16 '11 at 21:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.