Re: nas-identifier and ldap.attrmap

> Hi!
>
> I am using freeradius 1.0.1 with an openldap backend (2.1.30). Therefor
> I am using the ldap.attrmap for mapping ldapentries to radiusattributes.
> Everything is configured correctly, mapping works. For example, I added
> a radiusAuthType with value REJECT and I couldn't authenticate. Even
> other entries works!!
>
> But for some reason, I have to add a NAS-Identifier to my
> ldap-attributes and that does NOT work! :-(
>
> Adding a NAS-Identifier to the users-file works, for example:
> steve Auth-Type := Local, User-Password == "testing", NAS-Identifier
> == "chilli"
> Reply-Message = "Hello %u"
> This line let's the user steve only authenticate, if there is a
> NAS-Identifier="chilli" in the access request!

Why are you putting Auth-Type := Local? I don't understand the reason for
that.

>
> Why doesn't it work with ldap? I added it to the ldap.attrmap-file, as
> a checkitem:
> checkItem NAS-Identifier radiusNASIdentifier
> I also extended the radius-ldap-schema for radiusNASIdentifier, and even
>
>
> It seems that my freeradius ignores this attribut!! :-(
>
> Has anyone ideas?
> thxs
> regards
> peda
>
> PS: radius-logfile-output:
> Following ldap entry exists:
> dn:uid=testuser,ou=radius,dc=xxx,dc=xxx
>
> uid: testuser
> cn: testuser
> objectClass: radiusprofile
> account
> radiusNASIdentifier: vpn
>
> In the Access-Request NAS-Identifier is chilli, so I shouldn't get
> authenticated, right?
>
> ...
> rlm_ldap: LDAP radiusnasidentifier mapped to RADIUS NAS-Identifier
> ...
> rlm_ldap: Adding radiusnasidentifier as NAS-Identifier, value vpn & op=21
> ...
> rad_recv: Access-Request packet from host 127.0.0.1:1052, id=0, length=200
> User-Name = "testuser"
> User-Password = "123456"
> NAS-IP-Address = 0.0.0.0
> Service-Type = Login-User
> Framed-IP-Address = 192.168.100.2
> Calling-Station-Id = "00-11-43-68-B6-C7"
> Called-Station-Id = "00-00-21-D7-27-EA"
> NAS-Identifier = "chilli"
> Acct-Session-Id = "426371ac00000000"
> NAS-Port-Type = Wireless-802.11
> NAS-Port = 0
> Message-Authenticator = 0x639366a805ea2fa073720e2f5427bf7f
> WISPr-Logoff-URL = "http://192.168.100.1:3990/logoff"
> Processing the authorize section of radiusd.conf
>

Where is the rest of the debug output? We can't see where it went wrong?
My guess (just a guess) is that its matching something in your users file
that is letting it through.

Please post all of your debug. Also, try taking out where you defined
Auth-Type := Local.



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html