(RADIATOR) ldap search problem

Simon Merckx simon.merckx at virgajesse.be
Tue Jun 21 04:37:02 CDT 2005


Hello Mike,

I have found the problem. When you make a user in Novell with another user as template. The name of the orginal user is stored in the field "other name" of the new user. So if you make a new user testadmin with test as a template, the field "other name" contains the name testadmin. You have to remove the names in the "other name" field.

thx for your help,

Simon 

-----Oorspronkelijk bericht-----
Van: owner-radiator at open.com.au
[mailto:owner-radiator at open.com.au]Namens Mike McCauley
Verzonden: dinsdag 21 juni 2005 2:42
Aan: simon.merckx at virgajesse.be
CC: radiator at open.com.au
Onderwerp: Re: (RADIATOR) ldap search problem


Hello Simon,


On Monday 20 June 2005 21:54, Simon Merckx wrote:
> Hi,
>
> I have configured radiator to do an ldap search on a Novell ldap server.
> When there are two usernames who begin with the same part (for example
> testadmin and test), it returns the first match it finds. So if the
> username should be test, radiator matches testadmin if that is the username
> it first finds in the ldap database. This is unwanted behavior. Is there an
> option to correct this? There seems to be nothing wrong with the Novell
> server.

That is very odd.
We have not seen that behaviour with other LDAP servers. We would expect to
see an exact match against the cn, not a leading substring match. See for
example the doc at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/search_filter_syntax.asp
and RFC 1960

You may want to confirm that behaviour with ldapsearch, using something like
this:

ldapsearch -h abc.vjz -b 'o=lan' '(cn=test)'

I suspect this will turn out to be an LDAP server configuration issue.

Cheers.

>
> my ldap config:
>
> <AuthBy LDAP2>
> 		# Tell Radiator how to talk to the LDAP server
> 		#Host		localhost
> 		Host		abc.vjz
> 		# You will only need these if your LDAP server
> 		# requires authentication. These are the examples
> 		# in a default OpenLDAP installation
> 		# see /etc/openldap/slapd.conf
> 		#AuthDN		cn=Manager, dc=example, dc=com
> 		#AuthPassword	secret
>
> 		# This the top of the search tree where users
> 		# will be found. It should match the configuration
> 		# of your server, see /etc/openldap/slapd.conf
> 		#BaseDN		dc=example, dc=com
> 		BaseDN		o=lan
>
> 		# This is the LDAP attribute to match the radius user name
> 		#UsernameAttr	cn
> 		UsernameAttr	cn
>
> 		# If you dont specify ServerChecksPassword, you
> 		# need to tell Radiator wjhich attribute contains
> 		# the password. It can be plaintext or encrypted
> 		#EncryptedPasswordAttr    userPassword
> 		#PasswordAttr	password
> 		ServerChecksPassword 1
>
> 		# You can use CheckAttr, ReplyAttr and AuthAttrDef
> 		# to specify check and reply attributes in the LDAP
> 		# database. See the reference manual for more
> 		# information
> 		#AuthAttrDef ipaddress,Framed-IP-Address,reply
>
> 		# These are the classic things to add to each users
> 		# reply to allow a PPP dialup session. It may be
> 		# different for your NAS. This will add some
> 		# reply items to everyone's reply
> #		AddToReply Framed-Protocol = PPP,\
> #        		Framed-IP-Netmask = 255.255.255.255,\
> #        		Framed-Routing = None,\
> #        		Framed-MTU = 1500,\
> #			Framed-Compression = Van-Jacobson-TCP-IP
>
> 		# You can enable debugging of the Net::LDAP
> 		# module with this:
> 		#Debug 255
>
> 		# With LDAP2, You can enable SSL or TLS with perl-ldap 0.22 and better
> 		# by setting UseSSL or UseTLS. Not supported on Windows
> 		#UseSSL
> 		# UseTLS
> 		# If you set UseSSL or UseTLS, also need to set these:
> 		#SSLCAClientCert certificates/cert-clt.pem
> 		#SSLCAClientKey whatever
> 		#  (certificates in PEM format)
> 		# Also need to set one of:
> 		#SSLCAFile certificates/demoCA/cacert.pem
> 		# SSLCAPath /path/to/file/containing/certificate/of/CA
> 		#  (certificates in PEM format)
> 		# These set the corresponding parameters in the
> 		# LDAPS connection (see perl-ldap docs)
> 		# Requires IO::Socket::SSL, Net::SSLeay and openssl
>
> 		# You can control the timout for connection failure,
> 		# plus the backoff time after failure. Timout defaults
> 		# to 10 secs and FailureBackoffTime to 10 mins
> 		# Timeout 2
> 		# FailureBackoffTime 10
>
> 		# With PostSearchHook you can do your own processing
> 		# of the LDAP data.
> 		# Arg 0 is the AuthBy LDAP object
> 		# Arg 1 is the user name being authenticated
> 		# Arg 2 is the received request packet
> 		# Arg 3 is the user object holding check and reply
> 		#  items for this user
> 		# Arg 4 is the search results handle, whose type
> 		#   depends on whether its LDAP, LDAP2, or LDAPSDK
> 		#PostSearchHook sub {print "PostSearchHook @_\n";\
> 		#	my $attr = $_[4]->get('someldapattr');\
> 		#	print "get attribute $attr\n";}
>
> 		# You can control the LDAP protocol version to be used
> 		# to talk to the LDAP server. OpenLDAP 2 requires
> 		# Version 3 unless you have 'allow bind_v2' in your
> 		# slapd.conf. Defaults to version 2
> 		Version 3
> 	</AuthBy>
>
>
> regards,
>
> Simon
>
>
> --
> Archive at http://www.open.com.au/archives/radiator/
> Announcements on radiator-announce at open.com.au
> To unsubscribe, email 'majordomo at open.com.au' with
> 'unsubscribe radiator' in the body of the message.

--
Mike McCauley                               mikem at open.com.au
Open System Consultants Pty. Ltd            Unix, Perl, Motif, C++, WWW
9 Bulbul Place Currumbin Waters QLD 4223 Australia   http://www.open.com.au
Phone +61 7 5598-7474                       Fax   +61 7 5598-7070

Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP etc on Unix, Windows, MacOS etc.

--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.



--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.


More information about the radiator mailing list