title: freeradius is not able to use LDAP to authenticate a user
body: <p>I am trying to connect LDAP with freeRADIUS so that freeRADIUS can use LDAP to search a user and authenticate it if userid &amp; password are correct. I m able to run radtest on localhost, and it correctly gives Access-Accept response when the valid user id and password are given, but when I use the actual client(here ARUBA-AP) for authentication, then it gives the following error. I tried a lot, but it is not working. Would you please providing some valuable insight ? I removed some error line due to character limit.</p>
  <pre><code>(0) Received Access-Request Id 122 from 192.168.20.40:52684 to 192.168.20.57:1812 length 210
  (0)   User-Name = &quot;myadav&quot;
  (0)   NAS-IP-Address = 192.168.20.40
  (0)   NAS-Port = 0
  (0)   NAS-Identifier = &quot;192.168.20.40&quot;
  (0)   NAS-Port-Type = Wireless-802.11
  (0)   Calling-Station-Id = &quot;204ef6703bf7&quot;
  (0)   Called-Station-Id = &quot;904c81c66872&quot;
  (0)   Service-Type = Login-User
  (0)   Framed-MTU = 1100
  (0)   EAP-Message = 0x0202000b016d7961646176
  (0)   Aruba-Essid-Name = &quot;test-aruba-network&quot;
  (0)   Aruba-Location-Id = &quot;90:4c:81:c6:68:72&quot;
  (0)   Aruba-AP-Group = &quot;aruba&quot;
  (0)   Aruba-Device-Type = &quot;Win 10&quot;
  (0)   Message-Authenticator = 0xafb1481e6af4e359d01829203e9c49eb
  (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  (0)   authorize {
  (0)     policy filter_username {
  (0)       if (&amp;User-Name) {
  (0)       if (&amp;User-Name)  -&gt; TRUE
  (0)       if (&amp;User-Name)  {
  (0)         if (&amp;User-Name =~ / /) {
  (0)         if (&amp;User-Name =~ / /)  -&gt; FALSE
  (0)         if (&amp;User-Name =~ /@[^@]*@/ ) {
  (0)         if (&amp;User-Name =~ /@[^@]*@/ )  -&gt; FALSE
  (0)         if (&amp;User-Name =~ /\.\./ ) {
  (0)         if (&amp;User-Name =~ /\.\./ )  -&gt; FALSE
  (0)         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))  {
  (0)         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))   -&gt; FALSE
  (0)         if (&amp;User-Name =~ /\.$/)  {
  (0)         if (&amp;User-Name =~ /\.$/)   -&gt; FALSE
  (0)         if (&amp;User-Name =~ /@\./)  {
  (0)         if (&amp;User-Name =~ /@\./)   -&gt; FALSE
  (0)       } # if (&amp;User-Name)  = notfound
  (0)     } # policy filter_username = notfound
  (0)     [preprocess] = ok
  (0)     [chap] = noop
  (0)     [mschap] = noop
  (0)     [digest] = noop
  (0) suffix: Checking for suffix after &quot;@&quot;
  (0) suffix: No '@' in User-Name = &quot;myadav&quot;, looking up realm NULL
  (0) suffix: No such realm &quot;NULL&quot;
  (0)     [suffix] = noop
  (0) eap: Peer sent EAP Response (code 2) ID 2 length 11
  (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
  (0)     [eap] = ok
  (0)   } # authorize = ok
  (0) Found Auth-Type = eap
  (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  (0)   authenticate {
  (0) eap: Peer sent packet with method EAP Identity (1)
  (0) eap: Calling submodule eap_md5 to process data
  (0) eap_md5: Issuing MD5 Challenge
  (0) eap: Sending EAP Request (code 1) ID 3 length 22
  (0) eap: EAP session adding &amp;reply:State = 0x9b57e8189b54ecd7
  (0)     [eap] = handled
  (0)   } # authenticate = handled
  (0) Using Post-Auth-Type Challenge
  (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  (0)   Challenge { ... } # empty sub-section is ignored
  (0) Sent Access-Challenge Id 122 from 192.168.20.57:1812 to 192.168.20.40:52684 length 0
  (0)   EAP-Message = 0x010300160410f4531143c5a4554de7e16e7ab196d9b3
  (0)   Message-Authenticator = 0x00000000000000000000000000000000
  (0)   State = 0x9b57e8189b54ecd78bdaca715fff9488
  (0) Finished request
  Waking up in 4.9 seconds.
  (1) Received Access-Request Id 123 from 192.168.20.40:52684 to 192.168.20.57:1812 length 224
  (1)   User-Name = &quot;myadav&quot;
  (1)   NAS-IP-Address = 192.168.20.40
  (1)   NAS-Port = 0
  (1)   NAS-Identifier = &quot;192.168.20.40&quot;
  (1)   NAS-Port-Type = Wireless-802.11
  (1)   Calling-Station-Id = &quot;204ef6703bf7&quot;
  (1)   Called-Station-Id = &quot;904c81c66872&quot;
  (1)   Service-Type = Login-User
  (1)   Framed-MTU = 1100
  (1)   EAP-Message = 0x02030007031915
  (1)   State = 0x9b57e8189b54ecd78bdaca715fff9488
  (1)   Aruba-Essid-Name = &quot;test-aruba-network&quot;
  (1)   Aruba-Location-Id = &quot;90:4c:81:c6:68:72&quot;
  (1)   Aruba-AP-Group = &quot;aruba&quot;
  (1)   Aruba-Device-Type = &quot;Win 10&quot;
  (1)   Message-Authenticator = 0xb4b5b75f90db6747111ada9a673fc162
  (1) session-state: No cached attributes
  (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  (1)   authorize {
  (1)     policy filter_username {
  (1)       if (&amp;User-Name) {
  (1)       if (&amp;User-Name)  -&gt; TRUE
  (1)       if (&amp;User-Name)  {
  (1)         if (&amp;User-Name =~ / /) {
  (1)         if (&amp;User-Name =~ / /)  -&gt; FALSE
  (1)         if (&amp;User-Name =~ /@[^@]*@/ ) {
  (1)         if (&amp;User-Name =~ /@[^@]*@/ )  -&gt; FALSE
  (1)         if (&amp;User-Name =~ /\.\./ ) {
  (1)         if (&amp;User-Name =~ /\.\./ )  -&gt; FALSE
  (1)         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))  {
  (1)         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))   -&gt; FALSE
  (1)         if (&amp;User-Name =~ /\.$/)  {
  (1)         if (&amp;User-Name =~ /\.$/)   -&gt; FALSE
  (1)         if (&amp;User-Name =~ /@\./)  {
  (1)         if (&amp;User-Name =~ /@\./)   -&gt; FALSE
  (1)       } # if (&amp;User-Name)  = notfound
  (1)     } # policy filter_username = notfound
  (1)     [preprocess] = ok
  (1)     [chap] = noop
  (1)     [mschap] = noop
  (1)     [digest] = noop
  (1) suffix: Checking for suffix after &quot;@&quot;
  (1) suffix: No '@' in User-Name = &quot;myadav&quot;, looking up realm NULL
  (1) suffix: No such realm &quot;NULL&quot;
  (1)     [suffix] = noop
  (1) eap: Peer sent EAP Response (code 2) ID 3 length 7
  (1) eap: No EAP Start, assuming it's an on-going EAP conversation
  (1)     [eap] = updated
  (1)     [files] = noop
  rlm_ldap (ldap): Reserved connection (0)
  (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
  (1) ldap:    --&gt; (uid=myadav)
  (1) ldap: Performing search in &quot;dc=testdomain,dc=com&quot; with filter &quot;(uid=myadav)&quot;, scope &quot;sub&quot;
  (1) ldap: Waiting for search result...
  (1) ldap: User object found at DN &quot;cn=manish yadav,ou=users,dc=testdomain,dc=com&quot;
  (1) ldap: Processing user attributes
  (1) ldap: control:Password-With-Header += '{MD5}QYyEpgb0QN7flOhLbgLu9Q=='
  rlm_ldap (ldap): Released connection (0)
  Need 5 more connections to reach 10 spares
  rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used
  rlm_ldap (ldap): Connecting to ldap://127.0.0.1:389
  rlm_ldap (ldap): Waiting for bind result...
  rlm_ldap (ldap): Bind successful
  (1)     [ldap] = updated
  (1)     [expiration] = noop
  (1)     [logintime] = noop
  (1) pap: Converted: &amp;control:Password-With-Header -&gt; &amp;control:MD5-Password
  (1) pap: Removing &amp;control:Password-With-Header
  (1) pap: Normalizing MD5-Password from base64 encoding, 24 bytes -&gt; 16 bytes
  (1) pap: WARNING: Auth-Type already set.  Not setting to PAP
  (1)     [pap] = noop
  (1)   } # authorize = updated
  (1) Found Auth-Type = eap
  (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  (1)   authenticate {
  (1) eap: Expiring EAP session with state 0x9b57e8189b54ecd7
  (1) eap: Finished EAP session with state 0x9b57e8189b54ecd7
  (1) eap: Previous EAP request found for state 0x9b57e8189b54ecd7, released from the list
  (1) eap: Peer sent packet with method EAP NAK (3)
  (1) eap: Found mutually acceptable type PEAP (25)
  (1) eap: Calling submodule eap_peap to process data
  (1) eap_peap: Initiating new TLS session
  (1) eap_peap: [eaptls start] = request
  (1) eap: Sending EAP Request (code 1) ID 4 length 6
  (1) eap: EAP session adding &amp;reply:State = 0x9b57e8189a53f1d7
  (1)     [eap] = handled
  (1)   } # authenticate = handled
  (1) Using Post-Auth-Type Challenge
  (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  (1)   Challenge { ... } # empty sub-section is ignored
  (1) Sent Access-Challenge Id 123 from 192.168.20.57:1812 to 192.168.20.40:52684 length 0
  (1)   EAP-Message = 0x010400061920
  (1)   Message-Authenticator = 0x00000000000000000000000000000000
  (1)   State = 0x9b57e8189a53f1d78bdaca715fff9488
  (1) Finished request
  Waking up in 4.9 seconds.
  (2) Received Access-Request Id 124 from 192.168.20.40:52684 to 192.168.20.57:1812 length 389
  (2)   User-Name = &quot;myadav&quot;
  (2)   NAS-IP-Address = 192.168.20.40
  (2)   NAS-Port = 0
  (2)   NAS-Identifier = &quot;192.168.20.40&quot;
  (2)   NAS-Port-Type = Wireless-802.11
  (2)   Calling-Station-Id = &quot;204ef6703bf7&quot;
  (2)   Called-Station-Id = &quot;904c81c66872&quot;
  (2)   Service-Type = Login-User
  (2)   Framed-MTU = 1100
  (2)   EAP-Message = 0x020400ac1980000000a2160303009d01000099030361c1be1eba3df1e2ca02f41839245a72bdace4e45f0789d97073fb48affbbb6f00002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000046000500050100000000000a00080006001d00170018000b00020100000d001a00180804080508060401050102010403050302030202060106030023000000170000ff01000100
  (2)   State = 0x9b57e8189a53f1d78bdaca715fff9488
  (2)   Aruba-Essid-Name = &quot;test-aruba-network&quot;
  (2)   Aruba-Location-Id = &quot;90:4c:81:c6:68:72&quot;
  (2)   Aruba-AP-Group = &quot;aruba&quot;
  (2)   Aruba-Device-Type = &quot;Win 10&quot;
  (2)   Message-Authenticator = 0xdf8cd3b270840a9c51b135c8733c4712
  (2) session-state: No cached attributes
  (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  (2)   authorize {
  (2)     policy filter_username {
  (2)       if (&amp;User-Name) {
  (2)       if (&amp;User-Name)  -&gt; TRUE
  (2)       if (&amp;User-Name)  {
  (2)         if (&amp;User-Name =~ / /) {
  (2)         if (&amp;User-Name =~ / /)  -&gt; FALSE
  (2)         if (&amp;User-Name =~ /@[^@]*@/ ) {
  (2)         if (&amp;User-Name =~ /@[^@]*@/ )  -&gt; FALSE
  (2)         if (&amp;User-Name =~ /\.\./ ) {
  (2)         if (&amp;User-Name =~ /\.\./ )  -&gt; FALSE
  (2)         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))  {
  (2)         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))   -&gt; FALSE
  (2)         if (&amp;User-Name =~ /\.$/)  {
  (2)         if (&amp;User-Name =~ /\.$/)   -&gt; FALSE
  (2)         if (&amp;User-Name =~ /@\./)  {
  (2)         if (&amp;User-Name =~ /@\./)   -&gt; FALSE
  (2)       } # if (&amp;User-Name)  = notfound
  (2)     } # policy filter_username = notfound
  (2)     [preprocess] = ok
  (2)     [chap] = noop
  (2)     [mschap] = noop
  (2)     [digest] = noop
  (2) suffix: Checking for suffix after &quot;@&quot;
  (2) suffix: No '@' in User-Name = &quot;myadav&quot;, looking up realm NULL
  (2) suffix: No such realm &quot;NULL&quot;
  (2)     [suffix] = noop
  (2) eap: Peer sent EAP Response (code 2) ID 4 length 172
  (2) eap: Continuing tunnel setup
  (2)     [eap] = ok
  (2)   } # authorize = ok
  (2) Found Auth-Type = eap
  (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  (2)   authenticate {
  (2) eap: Expiring EAP session with state 0x9b57e8189a53f1d7
  (2) eap: Finished EAP session with state 0x9b57e8189a53f1d7
  (2) eap: Previous EAP request found for state 0x9b57e8189a53f1d7, released from the list
  (2) eap: Peer sent packet with method EAP PEAP (25)
  (2) eap: Calling submodule eap_peap to process data
  (2) eap_peap: Continuing EAP-TLS
  (2) eap_peap: Peer indicated complete TLS record size will be 162 bytes
  (2) eap_peap: Got complete TLS record (162 bytes)
  (2) eap_peap: [eaptls verify] = length included
  (2) eap_peap: (other): before SSL initialization
  (2) eap_peap: TLS_accept: before SSL initialization
  (2) eap_peap: TLS_accept: before SSL initialization
  (2) eap_peap: &lt;&lt;&lt; recv TLS 1.3  [length 009d] 
  (2) eap_peap: TLS_accept: SSLv3/TLS read client hello
  (2) eap_peap: &gt;&gt;&gt; send TLS 1.2  [length 003d] 
  (2) eap_peap: TLS_accept: SSLv3/TLS write server hello
  (2) eap_peap: &gt;&gt;&gt; send TLS 1.2  [length 02de] 
  (2) eap_peap: TLS_accept: SSLv3/TLS write certificate
  (2) eap_peap: &gt;&gt;&gt; send TLS 1.2  [length 014d] 
  (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange
  (2) eap_peap: &gt;&gt;&gt; send TLS 1.2  [length 0004] 
  (2) eap_peap: TLS_accept: SSLv3/TLS write server done
  (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done
  (2) eap_peap: TLS - In Handshake Phase
  (2) eap_peap: TLS - got 1152 bytes of data
  (2) eap_peap: [eaptls process] = handled
  (2) eap: Sending EAP Request (code 1) ID 5 length 1004
  (2) eap: EAP session adding &amp;reply:State = 0x9b57e8189952f1d7
  (2)     [eap] = handled
  (2)   } # authenticate = handled
  (2) Using Post-Auth-Type Challenge
  </code></pre>