Re: Authenticating using LDAP module

2003-09-19 Thread Kostas Kalevras 
On Thu, 18 Sep 2003, Vishal Jose wrote:

 On Thu, 18 Sep 2003 12:30:02 +0300 (EEST)
 Kostas Kalevras [EMAIL PROTECTED] wrote:

   What I need now is CHAP-Password type to be
   send across to Radius Server from Client.My password in the LDAP database is
   plain text.I would like to know what is addition that to be given in
   radiusd.conf if necessary?
 
  This has been discussed many times in the list. Check the list archives. Also
  doc/rlm_ldap includes plenty of information on the subject.


 B'4 posting the former mail I checked out the mailing listBut still I didn't 
 able to figure out.Sorry if I have missed to pin point something

 When I issue command say

 $ echo User-Name = \vishal\, CHAP-Password = \vishal\ | radclient -x  -s 
 10.0.1.180 auth testing123

 $ radiusd -x
 rad_recv: Access-Request packet from host 10.0.1.180:1122, id=128, length=47
 User-Name = vishal
 CHAP-Password = 0x80c8b36527f114b9b5845eee357625c2b4
   rlm_chap: Setting 'Auth-Type := CHAP'
 rlm_ldap: - authorize
 rlm_ldap: performing user authorization for vishal
 ldap_get_conn: Got Id: 0
 rlm_ldap: looking for check items in directory...
 rlm_ldap: Adding sn as User-Name, value vishal  op=21
 rlm_ldap: looking for reply items in directory...
 rlm_ldap: user vishal authorized to use remote access
 ldap_release_conn: Release Id: 0
   rlm_chap: login attempt by vishal with CHAP password ??e'?^?5v%??
   rlm_chap: Could not find clear text password for user vishal

So the user clear text password is not available. This means that rlm_ldap does
not extract the corresponding password from the user ldap entry

 rad_recv: Access-Request packet from host 10.0.1.180:1122, id=128, length=47
 Sending Access-Reject of id 128 to 10.0.1.180:1122


 my radiusd.conf is
 ldap{

   server = 10.0.1.180
   basedn = o=icope
 filter = cn=%u
   password_attribute = userPassword
 password_header = {clear}

Based on your posted user entry:

dn: cn=vishal,o=icope
sn: vishal
cn: vishal
userPassword: vishal
objectClass: person
telephoneNumber: 5716909
description: He is a employee


You don't need to set password_header. So leave it commented out.

 dictionary_mapping = ${raddbdir}/ldap.attrmap
 timeout = 4
 timelimit = 3
 net_timeout = 1
 ldap_debug = 0x


--
Kostas Kalevras Network Operations Center
[EMAIL PROTECTED]   National Technical University of Athens, Greece
Work Phone: +30 210 7721861
'Go back to the shadow' Gandalf

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authenticating using LDAP module

2003-09-18 Thread Vishal Jose 

Kostas Kalevras [EMAIL PROTECTED] wrote:

  filter = uid=%u
 
 Hmm, that should be cn=%u for things to work.

Thanx,it solved my problem.What I need now is CHAP-Password type to be send 
across to Radius Server from Client.My password in the LDAP database is plain text.I 
would like to know what is addition that to be given in radiusd.conf if necessary?

Thanx

-Vishal

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authenticating using LDAP module

2003-09-18 Thread Kostas Kalevras 
On Wed, 17 Sep 2003, Narasimha Reddy Gujja wrote:

 Quoting [EMAIL PROTECTED]:

  Send Freeradius-Users mailing list submissions to
  [EMAIL PROTECTED]
 
  To subscribe or unsubscribe via the World Wide Web, visit
  http://lists.cistron.nl/mailman/listinfo/freeradius-users
  or, via email, send a message with subject or body 'help' to
  [EMAIL PROTECTED]
 
  You can reach the person managing the list at
  [EMAIL PROTECTED]
 
  When replying, please edit your Subject line so it is more specific
  than Re: Contents of Freeradius-Users digest...
 
 

 there seems to be a problem with radius interpreting the IP address of the ldap
 machine. even if you give ldap://ipaddr it wont contact the ldap server, OR
 maybe not maybe iam ignorant.(-; , just my view.

You will need to have HAVE_LDAP_INITIALIZE defined during compilation of
rlm_ldap for ldap urls to be accepted. The configure script of rlm_ldap needs to
be updated to find if ldap_initialize() is available.


 when you used localhost did you put it in quote like localhost, if not try that.

 and how do you want to use ldap for authenticate without using userPassword
 attribute in your ldap entry??

 Reddy
 ([EMAIL PROTECTED])



 -
 This mail sent through IMP: http://horde.org/imp/

 -
 List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


--
Kostas Kalevras Network Operations Center
[EMAIL PROTECTED]   National Technical University of Athens, Greece
Work Phone: +30 210 7721861
'Go back to the shadow' Gandalf

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authenticating using LDAP module

2003-09-18 Thread Kostas Kalevras 
On Thu, 18 Sep 2003, Vishal Jose wrote:


 Kostas Kalevras [EMAIL PROTECTED] wrote:

   filter = uid=%u
 
  Hmm, that should be cn=%u for things to work.

 Thanx,it solved my problem.What I need now is CHAP-Password type to be
 send across to Radius Server from Client.My password in the LDAP database is
 plain text.I would like to know what is addition that to be given in
 radiusd.conf if necessary?

This has been discussed many times in the list. Check the list archives. Also
doc/rlm_ldap includes plenty of information on the subject.


 Thanx

 -Vishal

 -
 List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


--
Kostas Kalevras Network Operations Center
[EMAIL PROTECTED]   National Technical University of Athens, Greece
Work Phone: +30 210 7721861
'Go back to the shadow' Gandalf

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authenticating using LDAP module

2003-09-18 Thread Vishal Jose 
On Thu, 18 Sep 2003 12:30:02 +0300 (EEST)
Kostas Kalevras [EMAIL PROTECTED] wrote:

  What I need now is CHAP-Password type to be
  send across to Radius Server from Client.My password in the LDAP database is
  plain text.I would like to know what is addition that to be given in
  radiusd.conf if necessary?
 
 This has been discussed many times in the list. Check the list archives. Also
 doc/rlm_ldap includes plenty of information on the subject.


B'4 posting the former mail I checked out the mailing listBut still I didn't able 
to figure out.Sorry if I have missed to pin point something

When I issue command say

$ echo User-Name = \vishal\, CHAP-Password = \vishal\ | radclient -x  -s 
10.0.1.180 auth testing123

$ radiusd -x 
rad_recv: Access-Request packet from host 10.0.1.180:1122, id=128, length=47
User-Name = vishal
CHAP-Password = 0x80c8b36527f114b9b5845eee357625c2b4
  rlm_chap: Setting 'Auth-Type := CHAP'
rlm_ldap: - authorize
rlm_ldap: performing user authorization for vishal
ldap_get_conn: Got Id: 0
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sn as User-Name, value vishal  op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user vishal authorized to use remote access
ldap_release_conn: Release Id: 0
  rlm_chap: login attempt by vishal with CHAP password ?ȳe'ñ?¹µ?^î5v%´
  rlm_chap: Could not find clear text password for user vishal
rad_recv: Access-Request packet from host 10.0.1.180:1122, id=128, length=47
Sending Access-Reject of id 128 to 10.0.1.180:1122


my radiusd.conf is
ldap{

server = 10.0.1.180 
basedn = o=icope
filter = cn=%u
password_attribute = userPassword
password_header = {clear}
dictionary_mapping = ${raddbdir}/ldap.attrmap
timeout = 4
timelimit = 3
net_timeout = 1
ldap_debug = 0x

}

authorize{

ldap
chap

}
authenticate{

Auth-Type CHAP{
chap
}

Auth-Type LDAP{
ldap
}
}


In Users file

I tried out with both (either of) entry given down and without also

DEFAULT  Auth-Type := LDAP
Fall-Through = yes

DEFAULT  Auth-Type := CHAP
Fall-Through = yes

If it is without CHAP the same settings is working smoothly.Where I'm failing once 
again?

Thanx 

-Vishal


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Authenticating using LDAP module

2003-09-17 Thread Vishal Jose 


I have a problem in(my radclient) getting authenticated by RADIUS Server using LDAP 
module.I have installed Openldap in my local machine.

Let me put the info about my files that I'm using.I'm very sorry if u people feel that 
this much info is not necessary to figure out problem...

Say my slapd.conf is the following:

--slapd.conf
include /usr/local/etc/openldap/schema/core.schema
 
pidfile /usr/local/var/slapd.pid
argsfile/usr/local/var/slapd.args

databasebdb
directory   /usr/local/var/openldap-data

index   objectClass eq

access to attribute=userPassword
by dn=cn=manager write
by anonymous auth
by self write
by * none
 
access to *
by dn=cn=manager write
by * read
 
access to dn=.*,ou=Roaming,o=morsnet
by dn=cn=manager write
by dnattr=owner write
 
suffix  o=icope
rootdn cn=manager,o=icope
rootpw coin

--/slapd.conf

and then I run LDAP service by using command

$ slapd -4 -d 2

Then I have added an user with the command ldapadd say

$ ldapadd -x -D cn=manager,o=icope -W -f base.ldif

It is successfully done.

where base.ldif is

--base.ldif

dn: o=icope
objectClass: organization
o: icope
 
dn: cn=manager,o=icope
objectclass: organizationalRole
cn: manager
 
dn: cn=vishal,o=icope
sn: vishal
cn: vishal
userPassword: vishal
objectClass: person
telephoneNumber: 5716909
description: He is a employee

--/base.ldif

For verifying I did ldapsearch

$  ldapsearch -x -b 'o=icope' '(objectclass=*)'
# LDAPv3
# base o=icope with scope sub
# filter: (objectclass=*)
# requesting: ALL
#
 
# icope
dn: o=icope
objectClass: organization
o: icope
 
# manager, icope
dn: cn=manager,o=icope
objectClass: organizationalRole
cn: manager
 
# vishal, icope
dn: cn=vishal,o=icope
sn: vishal
cn: vishal
objectClass: person
telephoneNumber: 5716909
description: He is a employee at icope
 
# search result
search: 2
result: 0 Success
 
# numResponses: 4
# numEntries: 3


Now let me put up my radiusd.conf(I have modified mine according to the posting given 
in http://lists.cistron.nl/pipermail/freeradius-users/2001-August/001646.html)

--radiusd.conf

modules{
ldap{

server = 10.0.1.180 
#server = localhost -Tried this also
#identity = cn=manager ,o=icope
#password = coin
basedn = o=icope
filter = uid=%u
dictionary_mapping = ${raddbdir}/ldap.attrmap
timeout = 4
timelimit = 3
net_timeout = 1
ldap_debug = 0x
}
}

instantiate{

expr
   }

authorize{
#preprocess -I tried with and without commneting this
ldap
 }

authenticate{

Auth-Type LDAP{
ldap
  }
 }

--/radiusd.conf

In the case of users file 
--users file

DEFAULT Auth-Type :=LDAP
Fall-Through=1

--/users file


Even I tried out putting this entry in LDAP attribute map file(ldap.attrmap)
--ldap.attrmap

CheckItem   User-Name   cn
CheckItem   User-Password   userPassword

--/ldap.attrmap

After all these settings when I try to run radclient say
$ echo User-Name = \vishal\, Password = \vishal\ | radclient -x  -s 10.0.1.180 
auth testing123

(The result in the client terminal is)

Sending Access-Request of id 95 to 10.0.1.180:1812
User-Name = vishal
Password = vishal
Re-sending Access-Request of id 95 to 10.0.1.180:1812
User-Name = vishal
Password = ;n\364C\212i\376f\007\367\355)\246\317\371\335
rad_recv: Access-Reject packet from host 10.0.1.180:1812, id=95, length=20
 
   Total approved auths:  0
 Total denied auths:  1

Meanwhile in the server end(I'm adding all the log from server end)

$ radiusd -x
Starting - reading configuration files ...
Using deprecated naslist file.  Support for this will go away soon.
Using deprecated clients file.  Support for this will go away soon.
Using deprecated realms file.  Support for this will go away soon.
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded LDAP
conns: (nil)
rlm_ldap: reading ldap-radius mappings from file /usr/local/etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP cn mapped to RADIUS User-Name
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP userPassword mapped to RADIUS User-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap:

Re: Authenticating using LDAP module

2003-09-17 Thread Kostas Kalevras 
On Wed, 17 Sep 2003, Vishal Jose wrote:



 I have a problem in(my radclient) getting authenticated by RADIUS Server using LDAP 
 module.I have installed Openldap in my local machine.

 Let me put the info about my files that I'm using.I'm very sorry if u people feel 
 that this much info is not necessary to figure out problem...

 Say my slapd.conf is the following:

 --radiusd.conf

 modules{
   ldap{

   server = 10.0.1.180
   #server = localhost -Tried this also
   #identity = cn=manager ,o=icope
   #password = coin
 basedn = o=icope
 filter = uid=%u

Hmm, that should be cn=%u for things to work.

 dictionary_mapping = ${raddbdir}/ldap.attrmap
 timeout = 4
 timelimit = 3
 net_timeout = 1
 ldap_debug = 0x
   }
 }

 Meanwhile in the server end(I'm adding all the log from server end)

 $ radiusd -x


Please use radiusd -X so that both debug levels are logged

 rad_recv: Access-Request packet from host 10.0.1.180:1088, id=104, length=46
 User-Name = vishal
 Password = vishal
 rlm_ldap: - authorize
 rlm_ldap: performing user authorization for vishal
 ldap_get_conn: Got Id: 0
 rlm_ldap: (re)connect to 10.0.1.180:389, authentication 0
 rlm_ldap: bind as / to 10.0.1.180:389
 rlm_ldap: waiting for bind result ...
 rlm_ldap: object not found or got ambiguous search result

The ldap search was not successful. Please increase the debug level in radiusd
(either -xx or -X) and check your ldap server logs.

 rlm_ldap: search failed
 ldap_release_conn: Release Id: 0
 rad_recv: Access-Request packet from host 10.0.1.180:1088, id=104, length=46
 Sending Access-Reject of id 104 to 10.0.1.180:1088

 How to look about this probs.As a newbie to RADIUS Server configuration, I'll 
 appreciate if somebody can help me out in figuring this problem.

 Thanx in advance

 -Vishal


 -
 List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


--
Kostas Kalevras Network Operations Center
[EMAIL PROTECTED]   National Technical University of Athens, Greece
Work Phone: +30 210 7721861
'Go back to the shadow' Gandalf

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authenticating using LDAP module

2003-09-17 Thread Chris Parker 
At 12:22 PM 9/17/2003, Kostas Kalevras wrote:
On Wed, 17 Sep 2003, Vishal Jose wrote:

 Meanwhile in the server end(I'm adding all the log from server end)

 $ radiusd -x
Please use radiusd -X so that both debug levels are logged
To increase the debug level, simply add additional -x ( lower case ),
as in 'radiusd -x -x'.  The -X ( upper case ) flag has other side effects
such as disabling threaded operation which may or may not be intended if
you simply need more verbose logging to determine an issue.
-Chris

--
   \\\|||///  \  StarNet Inc.  \ Chris Parker
   \ ~   ~ /   \   WX *is* Wireless!\   Director, Engineering
   | @   @ |\   http://www.starnetwx.net \  (847) 963-0116
oOo---(_)---oOo--\--
  \ Wholesale Internet Services - http://www.megapop.net


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authenticating using LDAP module

2003-09-17 Thread Narasimha Reddy Gujja 
Quoting [EMAIL PROTECTED]:

 Send Freeradius-Users mailing list submissions to
   [EMAIL PROTECTED]
 
 To subscribe or unsubscribe via the World Wide Web, visit
   http://lists.cistron.nl/mailman/listinfo/freeradius-users
 or, via email, send a message with subject or body 'help' to
   [EMAIL PROTECTED]
 
 You can reach the person managing the list at
   [EMAIL PROTECTED]
 
 When replying, please edit your Subject line so it is more specific
 than Re: Contents of Freeradius-Users digest...
 
 

there seems to be a problem with radius interpreting the IP address of the ldap
machine. even if you give ldap://ipaddr it wont contact the ldap server, OR
maybe not maybe iam ignorant.(-; , just my view.

when you used localhost did you put it in quote like localhost, if not try that.

and how do you want to use ldap for authenticate without using userPassword
attribute in your ldap entry??

Reddy
([EMAIL PROTECTED])



-
This mail sent through IMP: http://horde.org/imp/

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html