Bug 1167846

Summary:	radiusd fails to load clients from ldap
Product:	Red Hat Enterprise Linux 7	Reporter:	David Spurek <dspurek>
Component:	freeradius	Assignee:	Nikolai Kondrashov <nikolai.kondrashov>
Status:	CLOSED ERRATA	QA Contact:	Jaroslav Aster <jaster>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.1	CC:	dpal, jaster, pkis
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 20:36:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1202751
Bug Blocks:	1205796

Description David Spurek 2014-11-25 14:07:25 UTC

Description of problem:
radiusd fails to load clients from ldap. remove localhost entry from clients.conf and add it to ldap. radtest then should work.

It will be fine to change ldap filter in clients section. Now is filter set to filter = '(objectClass=frClient)' but freeradius.schema in freeradius-doc has objectclasses radiusObjectProfile and radiusprofile,

Version-Release number of selected component (if applicable):
freeradius-3.0.4-4.el7

How reproducible:
always

Steps to Reproduce:
1.echo '' > /etc/raddb/clients.conf 
2.
uncomment 
shortname = 'radiusClientShortname'
nas_type = 'radiusClientType'

in /etc/raddb/mods-enabled/ldap
3. add client localhost entry to ldap

dn: radiusClientShortname=localhost,ou=Clients,dc=example,dc=com
objectclass: radiusClient
radiusClientIdentifier: 127.0.0.1
radiusClientSecret: testing123
radiusClientShortname: localhost
radiusClientType: other

4. service radiusd start
5. try radtest query to localhost, for example
radtest user redhat localhost 0 testing123

Actual results:
radtest fails and radiusd shows following output:

Ignoring request to auth address * port 1812 as server default from unknown client 127.0.0.1 port 55634 proto udp




Expected results:
radtest should pass

Additional info:
server doesn't search clients in ldap (I don't see searches in ldap)

Comment 1 Nikolai Kondrashov 2014-12-04 08:28:22 UTC

David, do you have a test which I can use to reproduce this?

Comment 8 Jaroslav Aster 2016-03-09 15:00:12 UTC

Hi,

I can confirm the bug. File /usr/share/doc/freeradius-3.0.4/schemas/ldap/openldap/freeradius-clients.schema defines objectClass with name radiusClient

objectclass ( 1.3.6.1.4.1.11344.1.100.1.1 
        NAME 'radiusClient' 
        DESC 'radiusClient object class' 
        SUP top 
        STRUCTURAL 
        MUST ( radiusClientIdentifier $ radiusClientSecret ) 
        MAY ( radiusClientShortname $ radiusClientVirtualServer $ radiusClientType $ radiusClientRequireMa $ radiusClientComment ) 
 )

, but there is a filter for clients in /etc/raddb/mods-available/ldap which searches objectClass frClient.

#
#  Filter to match client objects
#
filter = '(objectClass=frClient)'

For administrator, it is easy to change the filter, but I think, we should keep it consistent. Fix is easy, change filter to

filter = '(objectClass=radiusClient)'

Comment 10 Nikolai Kondrashov 2016-04-19 10:43:45 UTC

Thanks for the investigation, Jaroslav, you saved me a great deal of time :)
I found that the new version has this fixed.

Comment 12 Nikolai Kondrashov 2017-02-15 16:47:17 UTC

This can be fixed with a rebase to 3.0.12.

Comment 16 errata-xmlrpc 2017-08-01 20:36:03 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1954