(RADIATOR) Radiator and LDAP2 - multiple realm
Hugh Irvine
hugh at open.com.au
Tue Oct 14 20:55:51 CDT 2003
Hello Steve -
I think I will need a bit more detail regarding your requirements, as I
am not sure I understand.
Could you also please send me a trace 4 debug from Radiator showing
what is happening.
regards
Hugh
On Wednesday, Oct 15, 2003, at 05:55 Australia/Melbourne, Steve
Caporossi wrote:
> I am running radiator 3.7.1 on RH7.3. We are, and have been using
> AuthBy UNIX and the Odyssey Client for months to authenticate our
> wireless users. Now, I would like to authenticate users based on
> whether or not they are trying to login to the domain or not. When a
> user logs in with domain\username, I have been unable to get the
> request to be handled by the proper handler. I have placed the rewrite
> username in multiple locations but, never see the handler being used,
> only the tunnelled by TTLS is ever invoked. I have read the manual
> but obviously missed something...Can someone point me in the right
> direction?
>
> As a workaround, I tried using ContinueUntilAccept in the tunnelled by
> TTLS handler and then I fail with the info below. I verified the
> username and password are correct so, is there another module >
> required?
>
> See below....
> Mon Oct 13 16:03:59 2003: DEBUG: Handling with Radius::AuthLDAP2:
> Mon Oct 13 16:03:59 2003: INFO: Connecting to <servername>, port 389
> Mon Oct 13 16:03:59 2003: INFO: Attempting to bind to LDAP server
> <servername>:389)
> Mon Oct 13 16:03:59 2003: ERR: Could not bind connection with
> CN=Radtest,OU=admin,DC=testrealm,DC=local, <password>, error:
> LDAP_INVALID_CREDENTIALS (server <servername>:389).
> Mon Oct 13 16:03:59 2003: ERR: Backing off from <servername>:389 for
> 600 seconds
>
> Thanks,
> --
> Steve
> <Client DEFAULT>
> Identifier wlan
> Secret mysecret
> DupInterval 2
> IgnoreAcctSignature
> </Client>
>
>
> <Handler TunnelledByTTLS=1,Realm=testrealm>
> AuthByPolicy ContinueUntilAccept
>
> # Strip realm if in MSN format
> RewriteUsername s/(.*)\\(.*)/$2/
>
> # strips the realm from a User-Name before authenticating it
> RewriteUsername s/^([^@]+).*/$1/
>
> <AuthBy LDAP2>
> Host dc1.labnet.local
> AuthDN CN=Radtest,OU=admin,DC=testrealm,DC=local
> AuthPassword <password>
> AuthPassword <password>
> BaseDN OU=AD Users,DC=testrealm,DC=local
> ServerChecksPassword
> UsernameAttr samaccountname
> </AuthBy>
>
> </Handler>
>
> <Handler TunnelledByTTLS=1>
> AuthByPolicy ContinueUntilAccept
>
> # Strip realm if in MSN format
> RewriteUsername s/(.*)\\(.*)/$2/
>
> # strips the realm from a User-Name before authenticating it
> RewriteUsername s/^([^@]+).*/$1/
>
> <AuthBy UNIX>
> # anonymous-PEAP must be in here:
> Filename /etc/wlanpeople
> </AuthBy>
> </Handler>
>
> <Handler Client-Identifier=wlan>
>
> AuthByPolicy ContinueAlways
> #AuthByPolicy ContinueWhileIgnore # Default
>
> # Strip realm if in MSN format
> # RewriteUsername s/(.*)\\(.*)/$2/
>
> # Convert a MSN realm\user into user at realm
> # RewriteUsername s/^(.*)\\(.*)/$2\@$1/
>
> # strips the realm from a User-Name before authenticating it
> # RewriteUsername s/^([^@]+).*/$1/
>
>
> <AuthBy SQL>
> DBSource dbi:mysql:radius
> DBSource
> dbi:mysql:database=radius;host=radserver.musc.edu
> DBUsername radtest
> DBAuth radpwd
>
> AuthSelect
>
> # Only insert Start and Stop requests, ack everything
> else
> HandleAcctStatusTypes Start,Stop
>
> AccountingTable ACCOUNTING
>
> AcctColumnDef USERNAME,User-Name
> AcctColumnDef CONNTYPE,%{Client:Identifier},formatted
> AcctColumnDef TIME_STAMP,Timestamp,integer
> AcctColumnDef
> TEXT_TIME_STAMP,Timestamp,integer-date,%Y-%m-%d %H:%M:%S
> AcctColumnDef ACCTSTATUSTYPE,Acct-Status-Type
> AcctColumnDef ACCTDELAYTIME,Acct-Delay-Time,integer
> AcctColumnDef ACCTSESSIONID,Acct-Session-Id
> AcctColumnDef
> ACCTSESSIONTIME,Acct-Session-Time,integer
> AcctColumnDef ACCTTERMINATECAUSE,Acct-Terminate-Cause
> AcctColumnDef NASIDENTIFIER,NAS-Identifier
> AcctColumnDef NASIPADDRESS,NAS-IP-Address
> AcctColumnDef NASPORT,NAS-Port,integer
> AcctColumnDef FRAMEDIPADDRESS,Framed-IP-Address
> AcctColumnDef ACCTAUTHENTIC,Acct-Authentic
>
> AcctFailedLogFileName
> %L/%{Client:Identifier}/%m%d%y.missedaccounting.log
> </AuthBy>
>
>
> <AuthBy FILE>
>
> # Strip realm if in MSN format
> # RewriteUsername s/(.*)\\(.*)/$2/
>
> # Convert a MSN realm\user into user at realm
> RewriteUsername s/^(.*)\\(.*)/$2\@$1/
>
> # strips the realm from a User-Name before authenticating it
> # RewriteUsername s/^([^@]+).*/$1/
>
> Filename /etc/radiator/users
>
> EAPType TTLS
>
> EAPTLS_CAFile /usr/local/certs/radtest.pem
>
> EAPTLS_CertificateFile /usr/local/certs/radtest.pem
> EAPTLS_CertificateType PEM
>
> EAPTLS_PrivateKeyFile /usr/local/certs/radtest.pem
> EAPTLS_PrivateKeyPassword <keypasswd>
>
> EAPTLS_MaxFragmentSize 1024
>
> AutoMPPEKeys
>
> SSLeayTrace 4
>
> # EAPAnonymous anonymous
>
> # Default is enabled
> #EAPTLS_SessionResumption 0
>
> #EAPTLS_SessionResumptionLimit 10
>
> </AuthBy>
>
> PreProcessingHook file:"/etc/radiator/eap_anon_hook.pl"
> PostAuthHook file:"/etc/radiator/eap_anon_hook.pl"
>
> # Log accounting to a detail file
> AcctLogFileName %L/%{Client:Identifier}/%m%d%y.log
>
> </Handler>
>
NB: have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
--
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
NB: have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
--
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
===
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list