(RADIATOR) Auth by SQL , then Auth by LDAP

al mccain mccainca at centurytel.net
Wed Apr 23 10:04:50 CDT 2003


Hello,

I'm having a problem which is this:

When a user logs in , it checks the SQL database, then checks LDAP .
What I want it to do is check the SQL database , if it finds a password, then don't check LDAP .
Right now, it finds a password in SQL , then can't find one in LDAP and denies the user.

Anyone know why this would happen and how to fix it ?

User cty23243 is found in ldap and will auth , but user dev1 is not in LDAP ,
but is in the database. However, he will not authenticate.

Here is my config and log file .

Thanks,
Al




Foreground
LogStdout
LogDir		.
DbDir		.

<Client DEFAULT>

	Secret letMEin
	DupInterval 0

</Client>

<SessionDatabase SQL>

	DBSource dbi:mysql:radius
	DBUsername XXXX
	DBAuth XXXX
	Identifier SQLS

		AddQuery insert into RADONLINE (USERNAME,\
		NASIDENTIFIER, NASPORT, ACCTSESSIONID, TIME_STAMP,\
		FRAMEDIPADDRESS, NASPORTTYPE, SERVICETYPE, ip) \
		values ('%n', '%N',\
		%{NAS-Port}, '%{Acct-Session-Id}', '%o',\
		'%{Framed-IP-Address}', '%{NAS-Port-Type}', \
		'%{Service-Type}', '%c')

</SessionDatabase>

	Trace 4

<ClientListSQL>

	DBSource	dbi:mysql:radius
        DBUsername	XXXX
	DBAuth		XXXX

</ClientListSQL>

<AuthBy SQL>
	DefaultSimultaneousUse 1
	Identifier CheckSQL
	DefaultSimultaneousUse 1

	DBSource	dbi:mysql:radius
	DBUsername      XXXX
	DBAuth		XXXX

		AccountingTable	ACCOUNTING
		AcctColumnDef	USERNAME,User-Name
		AcctColumnDef	TIME_STAMP,Timestamp,integer
		AcctColumnDef	ACCTSTATUSTYPE,Acct-Status-Type
		AcctColumnDef	ACCTDELAYTIME,Acct-Delay-Time,integer
		AcctColumnDef	ACCTINPUTOCTETS,Acct-Input-Octets,integer
		AcctColumnDef	ACCTOUTPUTOCTETS,Acct-Output-Octets,integer
		AcctColumnDef	ACCTSESSIONID,Acct-Session-Id
		AcctColumnDef	ACCTSESSIONTIME,Acct-Session-Time,integer
		AcctColumnDef	ACCTTERMINATECAUSE,Acct-Terminate-Cause
		AcctColumnDef	NASIDENTIFIER,NAS-Identifier
		AcctColumnDef	NASPORT,NAS-Port,integer
		AcctColumnDef	FRAMEDIPADDRESS,Framed-IP-Address

</AuthBy>

<AuthBy UNIX>

	DefaultSimultaneousUse 1
        Identifier System
        Filename /etc/shadow

</AuthBy>

<AuthBy PORTLIMITCHECK>

	DefaultSimultaneousUse 1
	Identifier checkport
        SessionLimit 1

</AuthBy PORTLIMITCHECK>

<AuthBy LDAP2>

        Identifier LDAP
        Host    127.0.0.1
        Port    389
        AuthDN  uid=searchuser,dc=XXXX,dc=net
        AuthPassword   XXXX
        BaseDN  %0=%1,ou=people,dc=XXXX,dc=net
        Scope   base
        UsernameAttr    uid
        PasswordAttr    userPassword
        HoldServerConnection
        SearchFilter (&(gecos=active)(uid=%1))
        AuthAttrDef gidNumber, gid-attr, request

</AuthBy>

<Realm DEFAULT>

	RewriteUsername s/^([^@]+).*/$1/
	RewriteUsername         s/\s+//g
	RewriteUsername         tr/A-Z/a-z/

 	AuthByPolicy ContinueAlways

		AuthBy CheckSQL
		AuthBy LDAP
		#AuthBy checkport

 	PostAuthHook file:"postHook"
        AcctLogFileName detail
</Realm>

-------------------------------------------------------------------------------

Wed Apr 23 09:46:59 2003: DEBUG: Adding Clients from SQL database
Wed Apr 23 09:46:59 2003: DEBUG: Query is: select
	NASIDENTIFIER,
	SECRET,
	IGNOREACCTSIGNATURE,
	DUPINTERVAL,
	DEFAULTREALM,
	NASTYPE,
	SNMPCOMMUNITY,
	LIVINGSTONOFFS,
	LIVINGSTONHOLE,
	FRAMEDGROUPBASEADDRESS,
	FRAMEDGROUPMAXPORTSPERCLASSC,
	REWRITEUSERNAME,
	NOIGNOREDUPLICATES,
	PREHANDLERHOOK from RADCLIENTLIST

Wed Apr 23 09:47:00 2003: DEBUG: Reading group file /etc/group
Wed Apr 23 09:47:02 2003: DEBUG: Creating authentication port 0.0.0.0:1645
Wed Apr 23 09:47:02 2003: DEBUG: Creating accounting port 0.0.0.0:1646
Wed Apr 23 09:47:02 2003: INFO: Server started: Radiator 3.4 on raddb-test
Wed Apr 23 09:47:19 2003: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 33026 ....
Code:       Access-Request
Identifier: 4
Authentic:  1234567890123456
Attributes:
	User-Name = "cty23243"
	Service-Type = Framed-User
	Client-Id = 203.63.154.1
	NAS-Port = 1234
	Called-Station-Id = "123456789"
	Calling-Station-Id = "987654321"
	NAS-Port-Type = Async
	User-Password = "<158><216><162>Y<171><142>Xx<31><235><251><167><228>B<161>d"

Wed Apr 23 09:47:19 2003: ERR: Error while rewriting username cty23243: syntax error at (eval 30) line 2, at EOF

Wed Apr 23 09:47:19 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:19 2003: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Wed Apr 23 09:47:19 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:19 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:19 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:19 2003: DEBUG: SQLS Deleting session for cty23243, 203.63.154.1, 1234
Wed Apr 23 09:47:19 2003: DEBUG: do query is: delete from RADONLINE where NASIDENTIFIER='203.63.154.1' and NASPORT=1234

Wed Apr 23 09:47:19 2003: DEBUG: Handling with Radius::AuthSQL
Wed Apr 23 09:47:19 2003: DEBUG: Handling with Radius::AuthSQL: CheckSQL
Wed Apr 23 09:47:19 2003: ERR: Attribute number 79 is not defined in your dictionary
Wed Apr 23 09:47:19 2003: DEBUG: Query is: select PASSWORD from SUBSCRIBERS where USERNAME='cty23243'

Wed Apr 23 09:47:19 2003: DEBUG: Radius::AuthSQL looks for match with cty23243
Wed Apr 23 09:47:19 2003: DEBUG: Query is: select PASSWORD from SUBSCRIBERS where USERNAME='DEFAULT'

Wed Apr 23 09:47:19 2003: DEBUG: Radius::AuthSQL looks for match with DEFAULT
Wed Apr 23 09:47:19 2003: DEBUG: Radius::AuthSQL REJECT: Bad Password
Wed Apr 23 09:47:19 2003: DEBUG: Query is: select PASSWORD from SUBSCRIBERS where USERNAME='DEFAULT1'

Wed Apr 23 09:47:20 2003: DEBUG: Radius::AuthSQL looks for match with DEFAULT1
Wed Apr 23 09:47:20 2003: DEBUG: Radius::AuthSQL REJECT: Bad Password
Wed Apr 23 09:47:20 2003: DEBUG: Query is: select PASSWORD from SUBSCRIBERS where USERNAME='DEFAULT2'

Wed Apr 23 09:47:20 2003: DEBUG: Handling with Radius::AuthLDAP2: LDAP
Wed Apr 23 09:47:20 2003: INFO: Connecting to 127.0.0.1, port 389
Wed Apr 23 09:47:20 2003: INFO: Attempting to bind with uid=searchuser,dc=XXXX,dc=net, XXXX (server 127.0.0.1:389)
Wed Apr 23 09:47:20 2003: DEBUG: LDAP got result for uid=cty23243,ou=People,dc=centurytel,dc=net
Wed Apr 23 09:47:20 2003: DEBUG: LDAP got userPassword: {crypt}8UyUp0jaGti9o
Wed Apr 23 09:47:20 2003: DEBUG: LDAP got gidNumber: 3000
Wed Apr 23 09:47:20 2003: DEBUG: Radius::AuthLDAP2 looks for match with cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Radius::AuthLDAP2 ACCEPT:
Wed Apr 23 09:47:20 2003: DEBUG: Access accepted for cty23243
Wed Apr 23 09:47:20 2003: WARNING: No such attribute Framed-IP-Netmask
Wed Apr 23 09:47:20 2003: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 33026 ....
Code:       Access-Accept
Identifier: 4
Authentic:  1234567890123456
Attributes:
	Service-Type = Framed-User
	Framed-Protocol = PPP
	Framed-IP-Address = 255.255.255.254
	Framed-IP-Netmask = 255.255.255.255
	Port-Limit = 1
	Idle-Timeout = 1200
	Session-Timeout = 28800
	Class = "dnd00"

Wed Apr 23 09:47:20 2003: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 33026 ....
Code:       Accounting-Request
Identifier: 5
Authentic:  <5><130><160><254><185>h<178><29><22><247>Q&<212><129><17>n
Attributes:
	User-Name = "cty23243"
	Service-Type = Framed-User
	Client-Id = 203.63.154.1
	NAS-Port = 1234
	NAS-Port-Type = Async
	Acct-Session-Id = "00001234"
	Acct-Status-Type = Start
	Called-Station-Id = "123456789"
	Calling-Station-Id = "987654321"
	Framed-IP-Address = 255.255.255.254
	Acct-Delay-Time = 0
	Class = "dnd00"

Wed Apr 23 09:47:20 2003: ERR: Error while rewriting username cty23243: syntax error at (eval 34) line 2, at EOF

Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: SQLS Adding session for cty23243, 203.63.154.1, 1234
Wed Apr 23 09:47:20 2003: DEBUG: do query is: delete from RADONLINE where NASIDENTIFIER='203.63.154.1' and NASPORT=1234

Wed Apr 23 09:47:20 2003: DEBUG: do query is: insert into RADONLINE (USERNAME,NASIDENTIFIER, NASPORT, ACCTSESSIONID, TIME_STAMP,FRAMEDIPADDRESS, NASPORTTYPE, SERVICETYPE, ip) values ('cty23243', '203.63.154.1',1234, '00001234', 'Wed Apr 23 09:47:20 2003','255.255.255.254', 'Async', 'Framed-User', '127.0.0.1')

Wed Apr 23 09:47:20 2003: DEBUG: Handling with Radius::AuthSQL
Wed Apr 23 09:47:20 2003: DEBUG: Handling accounting with Radius::AuthSQL
Wed Apr 23 09:47:20 2003: DEBUG: do query is: insert into ACCOUNTING (NASPORT,ACCTDELAYTIME,USERNAME,FRAMEDIPADDRESS,ACCTSTATUSTYPE,ACCTSESSIONID,TIME_STAMP) values (1234,0,'cty23243','255.255.255.254','Start','00001234',1051109240)

Wed Apr 23 09:47:20 2003: DEBUG: Handling with Radius::AuthLDAP2: LDAP
Wed Apr 23 09:47:20 2003: DEBUG: Accounting accepted
Wed Apr 23 09:47:20 2003: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 33026 ....
Code:       Accounting-Response
Identifier: 5
Authentic:  <5><130><160><254><185>h<178><29><22><247>Q&<212><129><17>n
Attributes:

Wed Apr 23 09:47:20 2003: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 33026 ....
Code:       Accounting-Request
Identifier: 6
Authentic:  <133><234>e'<29><194>o*<238><174><168>g<215><246><29>3
Attributes:
	User-Name = "cty23243"
	Service-Type = Framed-User
	Client-Id = 203.63.154.1
	NAS-Port = 1234
	NAS-Port-Type = Async
	Acct-Session-Id = "00001234"
	Acct-Status-Type = Stop
	Called-Station-Id = "123456789"
	Calling-Station-Id = "987654321"
	Framed-IP-Address = 255.255.255.254
	Acct-Delay-Time = 0
	Acct-Session-Time = 1000
	Acct-Input-Octets = 20000
	Acct-Output-Octets = 30000
	Class = "dnd00"

Wed Apr 23 09:47:20 2003: ERR: Error while rewriting username cty23243: syntax error at (eval 38) line 2, at EOF

Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: Rewrote user name to cty23243
Wed Apr 23 09:47:20 2003: DEBUG: SQLS Deleting session for cty23243, 203.63.154.1, 1234
Wed Apr 23 09:47:20 2003: DEBUG: do query is: delete from RADONLINE where NASIDENTIFIER='203.63.154.1' and NASPORT=1234

Wed Apr 23 09:47:20 2003: DEBUG: Handling with Radius::AuthSQL
Wed Apr 23 09:47:20 2003: DEBUG: Handling accounting with Radius::AuthSQL
Wed Apr 23 09:47:20 2003: DEBUG: do query is: insert into ACCOUNTING (NASPORT,ACCTSESSIONTIME,ACCTDELAYTIME,ACCTINPUTOCTETS,USERNAME,FRAMEDIPADDRESS,ACCTOUTPUTOCTETS,ACCTSTATUSTYPE,ACCTSESSIONID,TIME_STAMP) values (1234,1000,0,20000,'cty23243','255.255.255.254',30000,'Stop','00001234',1051109240)

Wed Apr 23 09:47:20 2003: DEBUG: Handling with Radius::AuthLDAP2: LDAP
Wed Apr 23 09:47:20 2003: DEBUG: Accounting accepted
Wed Apr 23 09:47:20 2003: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 33026 ....
Code:       Accounting-Response
Identifier: 6
Authentic:  <133><234>e'<29><194>o*<238><174><168>g<215><246><29>3
Attributes:

Wed Apr 23 09:47:33 2003: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 33027 ....
Code:       Access-Request
Identifier: 18
Authentic:  1234567890123456
Attributes:
	User-Name = "dev1"
	Service-Type = Framed-User
	Client-Id = 203.63.154.1
	NAS-Port = 1234
	Called-Station-Id = "123456789"
	Calling-Station-Id = "987654321"
	NAS-Port-Type = Async
	User-Password = "<219><138><165>p<129><151><0><2><31><235><251><167><228>B<161>d"

Wed Apr 23 09:47:33 2003: ERR: Error while rewriting username dev1: syntax error at (eval 42) line 2, at EOF

Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: SQLS Deleting session for dev1, 203.63.154.1, 1234
Wed Apr 23 09:47:33 2003: DEBUG: do query is: delete from RADONLINE where NASIDENTIFIER='203.63.154.1' and NASPORT=1234

Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthSQL
Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthSQL: CheckSQL
Wed Apr 23 09:47:33 2003: ERR: Attribute number 79 is not defined in your dictionary
Wed Apr 23 09:47:33 2003: DEBUG: Query is: select PASSWORD from SUBSCRIBERS where USERNAME='dev1'

Wed Apr 23 09:47:33 2003: DEBUG: Radius::AuthSQL looks for match with dev1
Wed Apr 23 09:47:33 2003: DEBUG: Query is: select NASIDENTIFIER, NASPORT, ACCTSESSIONID, FRAMEDIPADDRESS from RADONLINE where USERNAME='dev1'

Wed Apr 23 09:47:33 2003: DEBUG: Radius::AuthSQL ACCEPT:
Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthLDAP2: LDAP
Wed Apr 23 09:47:33 2003: ERR: ldap search failed with error LDAP_NO_SUCH_OBJECT.
Wed Apr 23 09:47:33 2003: DEBUG: Radius::AuthLDAP2 looks for match with dev1
Wed Apr 23 09:47:33 2003: ERR: ldap search failed with error LDAP_NO_SUCH_OBJECT.
Wed Apr 23 09:47:33 2003: INFO: Access rejected for dev1: No such user
Wed Apr 23 09:47:33 2003: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 33027 ....
Code:       Access-Reject
Identifier: 18
Authentic:  1234567890123456
Attributes:
	Port-Message = "Request Denied"

Wed Apr 23 09:47:33 2003: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 33027 ....
Code:       Accounting-Request
Identifier: 19
Authentic:  <191>x<216>m<229>i<163>h<148><229>$<138>@<172><245>G
Attributes:
	User-Name = "dev1"
	Service-Type = Framed-User
	Client-Id = 203.63.154.1
	NAS-Port = 1234
	NAS-Port-Type = Async
	Acct-Session-Id = "00001234"
	Acct-Status-Type = Start
	Called-Station-Id = "123456789"
	Calling-Station-Id = "987654321"
	Acct-Delay-Time = 0

Wed Apr 23 09:47:33 2003: ERR: Error while rewriting username dev1: syntax error at (eval 46) line 2, at EOF

Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: SQLS Adding session for dev1, 203.63.154.1, 1234
Wed Apr 23 09:47:33 2003: DEBUG: do query is: delete from RADONLINE where NASIDENTIFIER='203.63.154.1' and NASPORT=1234

Wed Apr 23 09:47:33 2003: DEBUG: do query is: insert into RADONLINE (USERNAME,NASIDENTIFIER, NASPORT, ACCTSESSIONID, TIME_STAMP,FRAMEDIPADDRESS, NASPORTTYPE, SERVICETYPE, ip) values ('dev1', '203.63.154.1',1234, '00001234', 'Wed Apr 23 09:47:33 2003','', 'Async', 'Framed-User', '127.0.0.1')

Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthSQL
Wed Apr 23 09:47:33 2003: DEBUG: Handling accounting with Radius::AuthSQL
Wed Apr 23 09:47:33 2003: DEBUG: do query is: insert into ACCOUNTING (NASPORT,ACCTDELAYTIME,USERNAME,ACCTSTATUSTYPE,ACCTSESSIONID,TIME_STAMP) values (1234,0,'dev1','Start','00001234',1051109253)

Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthLDAP2: LDAP
Wed Apr 23 09:47:33 2003: DEBUG: Accounting accepted
Wed Apr 23 09:47:33 2003: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 33027 ....
Code:       Accounting-Response
Identifier: 19
Authentic:  <191>x<216>m<229>i<163>h<148><229>$<138>@<172><245>G
Attributes:

Wed Apr 23 09:47:33 2003: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 33027 ....
Code:       Accounting-Request
Identifier: 20
Authentic:  <173>l<218>A<135>I<212>V<142><14><254><5><140>3Y<142>
Attributes:
	User-Name = "dev1"
	Service-Type = Framed-User
	Client-Id = 203.63.154.1
	NAS-Port = 1234
	NAS-Port-Type = Async
	Acct-Session-Id = "00001234"
	Acct-Status-Type = Stop
	Called-Station-Id = "123456789"
	Calling-Station-Id = "987654321"
	Acct-Delay-Time = 0
	Acct-Session-Time = 1000
	Acct-Input-Octets = 20000
	Acct-Output-Octets = 30000

Wed Apr 23 09:47:33 2003: ERR: Error while rewriting username dev1: syntax error at (eval 50) line 2, at EOF

Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Handling request with Handler 'Realm=DEFAULT'
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: Rewrote user name to dev1
Wed Apr 23 09:47:33 2003: DEBUG: SQLS Deleting session for dev1, 203.63.154.1, 1234
Wed Apr 23 09:47:33 2003: DEBUG: do query is: delete from RADONLINE where NASIDENTIFIER='203.63.154.1' and NASPORT=1234

Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthSQL
Wed Apr 23 09:47:33 2003: DEBUG: Handling accounting with Radius::AuthSQL
Wed Apr 23 09:47:33 2003: DEBUG: do query is: insert into ACCOUNTING (NASPORT,ACCTSESSIONTIME,ACCTDELAYTIME,ACCTINPUTOCTETS,USERNAME,ACCTOUTPUTOCTETS,ACCTSTATUSTYPE,ACCTSESSIONID,TIME_STAMP) values (1234,1000,0,20000,'dev1',30000,'Stop','00001234',1051109253)

Wed Apr 23 09:47:33 2003: DEBUG: Handling with Radius::AuthLDAP2: LDAP
Wed Apr 23 09:47:33 2003: DEBUG: Accounting accepted
Wed Apr 23 09:47:33 2003: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 33027 ....
Code:       Accounting-Response
Identifier: 20
Authentic:  <173>l<218>A<135>I<212>V<142><14><254><5><140>3Y<142>
Attributes:



===
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.


More information about the radiator mailing list