0001677: No VLAN name can be found when doing EAP - PacketFence

(0003372)
fdurand (administrator)
2013-08-01 21:05

Hello Victor,
it's normal and i will explain why.
In packetfence your probably set an active directory authentication source with the user attribute cn.
When you do mac authentication the username is victor.shustov@comtech.ca and match with an ldap search.
But when you do dot1x the user attribute is victor.shustov so it miss @comtech.ca and it doesn't match with the cn.
What you have to do is in the packetfence-tunnel file to change the post-auth section with something like that:

post-auth {
        exec
        if ( User-Name =~ /^[^\\]+[\\]+([^\\]+)/ ) {
                update request {
                    User-Name := "%{1}";
            }
        }
        update request {
            User-Name := "%{User-Name}@comtech.ca";
        packetfence
        Post-Auth-Type REJECT {
                attr_filter.access_reject
        }
}

Fabrice

(0003379)
victor (reporter)
2013-08-02 11:41

Gotcha! Thanks Fabrice.

I added username victor.shustov with appropriate role to the Users list to test and it works now.

Aug 02 09:19:16 pf::WebAPI(10390) INFO: MAC: 64:80:99:6e:68:c0, PID: asd@test.com, Status: reg. Returned VLAN: 84 (pf::vlan::fetchVlanForNode)

But that brings me to another problem I planned to deal with later: broken LDAP username lookup

Aug 01 11:48:44 register.cgi(0) WARN: Unexpected number of entries found (Net::LDAP::Search=HASH(0xba7ec694)->count) with filter (sAMAccountName=victor.shustov) from ou=Comtech,dc=comtech on 10.X.X.X:389 (pf::Authentication::Source::LDAPSource::authenticate)

I will keep digging into it but if you know a solution off top of your head please tell me ;-)

(0003381)
fdurand (administrator)
2013-08-02 12:21

But should it be sAMAccountName=victor.shustov@comtech.ca ?

(0003382)
victor (reporter)
2013-08-02 12:26

No

ldapsearch -h X.X.X.X -p 389 -D "CN=***,OU=***,OU=Comtech,DC=comtech" -b "OU=Comtech,DC=comtech" -w *** -x sAMAccountName=victor.shustov sAMAccountName

# extended LDIF
#
# LDAPv3
# base <OU=Comtech,DC=comtech> with scope subtree
# filter: sAMAccountName=victor.shustov
# requesting: sAMAccountName
#

# Victor Shustov, IT, Comtech, comtech
dn: CN=Victor Shustov,OU=IT,OU=Comtech,DC=comtech
sAMAccountName: victor.shustov

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

(0003383)
victor (reporter)
2013-08-02 14:03

Never mind. My bad. Should have set LDAP scope to subtree. Now it's all good

(0003953)
lmunro (administrator)
2015-02-18 11:03

Not a bug.

Notes
(0003372) fdurand (administrator) 2013-08-01 21:05	Hello Victor, it's normal and i will explain why. In packetfence your probably set an active directory authentication source with the user attribute cn. When you do mac authentication the username is victor.shustov@comtech.ca and match with an ldap search. But when you do dot1x the user attribute is victor.shustov so it miss @comtech.ca and it doesn't match with the cn. What you have to do is in the packetfence-tunnel file to change the post-auth section with something like that: post-auth { exec if ( User-Name =~ /^[^\\]+[\\]+([^\\]+)/ ) { update request { User-Name := "%{1}"; } } update request { User-Name := "%{User-Name}@comtech.ca"; packetfence Post-Auth-Type REJECT { attr_filter.access_reject } } Fabrice

(0003379) victor (reporter) 2013-08-02 11:41	Gotcha! Thanks Fabrice. I added username victor.shustov with appropriate role to the Users list to test and it works now. Aug 02 09:19:16 pf::WebAPI(10390) INFO: MAC: 64:80:99:6e:68:c0, PID: asd@test.com, Status: reg. Returned VLAN: 84 (pf::vlan::fetchVlanForNode) But that brings me to another problem I planned to deal with later: broken LDAP username lookup Aug 01 11:48:44 register.cgi(0) WARN: Unexpected number of entries found (Net::LDAP::Search=HASH(0xba7ec694)->count) with filter (sAMAccountName=victor.shustov) from ou=Comtech,dc=comtech on 10.X.X.X:389 (pf::Authentication::Source::LDAPSource::authenticate) I will keep digging into it but if you know a solution off top of your head please tell me ;-)

(0003381) fdurand (administrator) 2013-08-02 12:21	But should it be sAMAccountName=victor.shustov@comtech.ca ?

(0003382) victor (reporter) 2013-08-02 12:26	No ldapsearch -h X.X.X.X -p 389 -D "CN=*,OU=,OU=Comtech,DC=comtech" -b "OU=Comtech,DC=comtech" -w ** -x sAMAccountName=victor.shustov sAMAccountName # extended LDIF # # LDAPv3 # base <OU=Comtech,DC=comtech> with scope subtree # filter: sAMAccountName=victor.shustov # requesting: sAMAccountName # # Victor Shustov, IT, Comtech, comtech dn: CN=Victor Shustov,OU=IT,OU=Comtech,DC=comtech sAMAccountName: victor.shustov # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

(0003383) victor (reporter) 2013-08-02 14:03	Never mind. My bad. Should have set LDAP scope to subtree. Now it's all good

(0003953) lmunro (administrator) 2015-02-18 11:03	Not a bug.

Issue History
Date Modified	Username	Field	Change
2013-08-01 18:24	victor	New Issue
2013-08-01 21:05	fdurand	Note Added: 0003372
2013-08-02 11:41	victor	Note Added: 0003379
2013-08-02 12:21	fdurand	Note Added: 0003381
2013-08-02 12:26	victor	Note Added: 0003382
2013-08-02 14:03	victor	Note Added: 0003383
2015-02-18 11:03	lmunro	Note Added: 0003953
2015-02-18 11:03	lmunro	Status	new => closed
2015-02-18 11:03	lmunro	Assigned To	=> lmunro
2015-02-18 11:03	lmunro	Resolution	open => won't fix

Relationships