RE: rlm_ldap - Attribute "User-Password" is required for authentication

I had the same problem a few weeks ago. In fact the ldap wasn't =
returning
the user-password so it wasn't working. Chack with ldapsearch to make =
the
querry directly to the ldap as if you were the radius and I think that =
you
will see that the userpassword is not returned. =20

> rlm_ldap: bind as / to localhost:389
> rlm_ldap: waiting for bind result ...
> rlm_ldap: Bind was successful
> rlm_ldap: performing search in ou=3Dusers,dc=3Dgibraltar,dc=3Dlocal, =
with

Make sure that the user/password in radiusd.conf for the user that will =
make
the search in the ldap is valid. I think that the radius is binding
anonymously on the ldap so it can read passwords. Another thing to note =
is
that you have to store passwords in clear text into the ldap.=20

ldap {
server =3D "myserver.mydomain.com"
identity =3D
"cn=3Dsome_user_that_can_read_passwords_on_the_lda p"
password =3D "password_for_this_user"
....

Regards,
--
Sebastien Cantos <scantos@technodiva.com>
Network / System Manager
Neopost DIVA=20

> -----Message d'origine-----
> De : freeradius-users-admin@lists.freeradius.org=20
> [mailto:freeradius-users-admin@lists.freeradius.org] De la=20
> part de guest01
> Envoy=E9 : mardi 8 mars 2005 15:44
> =C0 : freeradius-users@lists.freeradius.org
> Objet : Re: rlm_ldap - Attribute "User-Password" is required=20
> for authentication
>=20
> hm, radius is very strange .... Can anyone please help me?
> this is the logfile output after testing with radexample:
>=20
> rad_recv: Access-Request packet from host 127.0.0.1:1025,=20
> id=3D40, length=3D66
> User-Name =3D "testuser"
> User-Password =3D "123456"
> Service-Type =3D Authenticate-Only
> NAS-IP-Address =3D 127.0.0.1
> NAS-Port =3D 0
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 0
> modcall[authorize]: module "preprocess" returns ok for request 0
> users: Matched DEFAULT at 152
> modcall[authorize]: module "files" returns ok for request 0
> rlm_ldap: - authorize
> rlm_ldap: performing user authorization for testuser
> radius_xlat: '(&(objectclass=3DgibraltarUser)(uid=3Dtestuser)) '
> radius_xlat: 'ou=3Dusers,dc=3Dgibraltar,dc=3Dlocal'
> rlm_ldap: ldap_get_conn: Checking Id: 0
> rlm_ldap: ldap_get_conn: Got Id: 0
> rlm_ldap: attempting LDAP reconnection
> rlm_ldap: (re)connect to localhost:389, authentication 0
> rlm_ldap: bind as / to localhost:389
> rlm_ldap: waiting for bind result ...
> rlm_ldap: Bind was successful
> rlm_ldap: performing search in ou=3Dusers,dc=3Dgibraltar,dc=3Dlocal, =
with
> filter (&(objectclass=3DgibraltarUser)(uid=3Dtestuser))
> rlm_ldap: checking if remote access for testuser is allowed=20
> by isVPNUser
> rlm_ldap: looking for check items in directory...
> rlm_ldap: looking for reply items in directory...
> rlm_ldap: user testuser authorized to use remote access
> rlm_ldap: ldap_release_conn: Release Id: 0
> modcall[authorize]: module "ldap" returns ok for request 0
> modcall: group authorize returns ok for request 0
> rad_check_password: Found Auth-Type LDAP
> auth: type "LDAP"
> Processing the authenticate section of radiusd.conf
> modcall: entering group Auth-Type for request 0
> rlm_ldap: - authenticate
> rlm_ldap: login attempt by "testuser" with password "123456"
> rlm_ldap: user DN: uid=3Dtestuser,ou=3Dusers,dc=3Dgibraltar,dc=3Dloca l
> rlm_ldap: (re)connect to localhost:389, authentication 1
> rlm_ldap: bind as=20
> uid=3Dtestuser,ou=3Dusers,dc=3Dgibraltar,dc=3Dloca l/123456 to
> localhost:389
> rlm_ldap: waiting for bind result ...
> rlm_ldap: Bind was successful
> rlm_ldap: user testuser authenticated succesfully
> modcall[authenticate]: module "ldap" returns ok for request 0
> modcall: group Auth-Type returns ok for request 0
> Sending Access-Accept of id 40 to 127.0.0.1:1025
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 6 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 40 with timestamp 422db560
> Nothing to do. Sleeping until we see a request.
>=20
> and this is the output after trying to connect via pptpd with=20
> winxp prof.
> Ready to process requests.
> rad_recv: Access-Request packet from host 127.0.0.1:1025,=20
> id=3D41, length=3D54
> Service-Type =3D Framed-User
> Framed-Protocol =3D PPP
> User-Name =3D "testuser"
> NAS-IP-Address =3D 66.150.161.140
> NAS-Port =3D 0
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 0
> modcall[authorize]: module "preprocess" returns ok for request 0
> users: Matched DEFAULT at 152
> users: Matched DEFAULT at 171
> users: Matched DEFAULT at 183
> modcall[authorize]: module "files" returns ok for request 0
> rlm_ldap: - authorize
> rlm_ldap: performing user authorization for testuser
> radius_xlat: '(&(objectclass=3DgibraltarUser)(uid=3Dtestuser)) '
> radius_xlat: 'ou=3Dusers,dc=3Dgibraltar,dc=3Dlocal'
> rlm_ldap: ldap_get_conn: Checking Id: 0
> rlm_ldap: ldap_get_conn: Got Id: 0
> rlm_ldap: attempting LDAP reconnection
> rlm_ldap: (re)connect to localhost:389, authentication 0
> rlm_ldap: bind as / to localhost:389
> rlm_ldap: waiting for bind result ...
> rlm_ldap: Bind was successful
> rlm_ldap: performing search in ou=3Dusers,dc=3Dgibraltar,dc=3Dlocal, =
with
> filter (&(objectclass=3DgibraltarUser)(uid=3Dtestuser))
> rlm_ldap: checking if remote access for testuser is allowed=20
> by isVPNUser
> rlm_ldap: looking for check items in directory...
> rlm_ldap: looking for reply items in directory...
> rlm_ldap: user testuser authorized to use remote access
> rlm_ldap: ldap_release_conn: Release Id: 0
> modcall[authorize]: module "ldap" returns ok for request 0
> modcall: group authorize returns ok for request 0
> rad_check_password: Found Auth-Type LDAP
> auth: type "LDAP"
> Processing the authenticate section of radiusd.conf
> modcall: entering group Auth-Type for request 0
> rlm_ldap: - authenticate
> rlm_ldap: Attribute "User-Password" is required for authentication.
> modcall[authenticate]: module "ldap" returns invalid for request 0
> modcall: group Auth-Type returns invalid for request 0
> auth: Failed to validate the user.
> Delaying request 0 for 1 seconds
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 41 to 127.0.0.1:1025
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 41 with timestamp 422db59d
> Nothing to do. Sleeping until we see a request.
>=20
> The first part, the authorize-part works fine, but the=20
> authentication-part
> will not work!!! Any ideas? In my radiusd.conf, I configured=20
> everything
> right (I think). Otherwise it wouldn't work with radexample=20
> or radtest.
>=20
> Just for understanding, what the hell does the authentication=20
> part do? What
> attributes do I need for it to get it work? Isn't=20
> radiusauthtype enough?
>=20
> I just want my users to authenticate via radius to my pptp=20
> server, I don't
> need special authentication attributes like radiussessiontime or
> whatever...
> I tried to set authenticate-only as default, but it didn't work
>=20
> please help!
> best regards
> peda
>=20
> PS: Debian woody, with freeradius 1.0.1 and ppp 2.4.3
>=20
>=20
>=20
>=20
>=20
>=20
> -=20
> List info/subscribe/unsubscribe? See=20
> http://www.freeradius.org/list/users.html
>=20


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html