> Hi > > Thxs for the fast reply!! > > Ok, user steve (the one with the Auth-Type := Local) exists only for > testing purposes. With user-data in die local users file, the > nas-identifier works!!!! > > So, I don't know why radius ignores my ldap data ...
Its not ignoring it, I think you just aren't telling it how to use it. I'll clip some of your log below and add some comments. > > rad_recv: Access-Request packet from host 127.0.0.1:1055, id=0, length=200 > User-Name = "testuser" > User-Password = "123456" > NAS-IP-Address = 0.0.0.0 > Service-Type = Login-User > Framed-IP-Address = 192.168.100.2 > Calling-Station-Id = "00-11-43-68-B6-C7" > Called-Station-Id = "00-00-21-D7-27-EA" > NAS-Identifier = "chilli" > Acct-Session-Id = "4263b69500000000" > NAS-Port-Type = Wireless-802.11 > NAS-Port = 0 > Message-Authenticator = 0x07bdf3d7094da860977e4a9592cf0684 > WISPr-Logoff-URL = "http://192.168.100.1:3990/logoff"; **Nas-Identifier is being sent over as chilli. > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > users: Matched DEFAULT at 145 ** line 145 is where you are matching your users file. What does that line of your users file say? > modcall[authorize]: module "files" returns ok for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for testuser > radius_xlat: '(&(objectclass=myserverUser)(uid=testuser))' > radius_xlat: 'ou=users,dc=myserver,dc=local' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to localhost:389, authentication 0 > rlm_ldap: bind as uid=radmin,ou=admin,dc=myserver,dc=local/123456 to > localhost:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in ou=users,dc=myserver,dc=local, with > filter (&(objectclass=myserverUser)(uid=testuser)) > rlm_ldap: checking if remote access for testuser is allowed by isVPNUser > rlm_ldap: performing search in > uid=testuser,ou=radius,dc=myserver,dc=local, with filter > (objectclass=radiusprofile) > rlm_ldap: Adding radiusNASIdentifier as NAS-Identifier, value vpn & op=21 ** rlm_ldap found your check-item of nas-identifier = vpn. > rlm_ldap: looking for check items in directory... > rlm_ldap: Adding userpassword as User-Password, value 123456 & op=21 > rlm_ldap: looking for reply items in directory... > rlm_ldap: user testuser authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: group authorize returns ok for request 0 ** You are being authorized as OK. That means that you aren't telling freeradius what the radiusNasIdentifier needs to be. The checkval module will check that the same nas-identifier in the packet must match what is in ldap. checkval { item-name = Nas-Identifier check-name = Nas-Identifier data-type = string notfound-reject = yes } That says that if nas-identifier in the packet is chilli, then you must have radiusnasidentifier of chilli in ldap. Or, if nas-identifier comes in with vpn, you must have nasidentifier of vpn in ldap. If not, reject the user. You then put checkval in authorize. eg: authorize { stuff.. ldap checkval } Hope that helps. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
