title: Configuring FreeRadius with LDAP for WPA2 Enterprise
body: <p>I need help configuring freeradius with WPA2 Enterprise via LDAP.</p>
  
  <p>LDAP normally works for other services, however, it does not work for WPA2E.</p>
  
  <p>We have also managed WPA2E to work with hard coded username/password fine. So we know all the components on their own work, but do not work together.</p>
  
  <p>We have the freeradius server configured fine to work with the LDAP service.</p>
  
  <p>Any help is appreciated</p>
  
  <p>Here is my ldap setting for free radius modules/ldap file (mostly irrelevant for this issue)</p>
  
  <pre><code>ldap {
      server = "ldapmaster.domain.com,ldapslave.domain.com"
      identity = "uid=binder,ou=services,dc=security,dc=domain,dc=com"
      password = asdfasdfasdf
      basedn = "ou=internal,ou=users,dc=security,dc=domain,dc=com"
      filter = "(mail=%{%{Stripped-User-Name}:-%{User-Name}})"
      ldap_connections_number = 5
      max_uses = 0
      timeout = 4
      timelimit = 3
      net_timeout = 1
  
      tls {
              start_tls = yes
              require_cert    = "never"
      }
  
      dictionary_mapping = ${confdir}/ldap.attrmap
      password_attribute = userPassword
      edir_account_policy_check = no
  
      keepalive {
              idle = 60
              probes = 3
              interval = 3
      }}
  </code></pre>
  
  <p>Also have the following setup for eap.conf</p>
  
  <pre><code>eap {
  default_eap_type = peap
  timer_expire     = 60
  ignore_unknown_eap_types = no
  cisco_accounting_username_bug = no
  max_sessions = 4096
  
  md5 {
  }
  
  leap {
  }
  
  gtc {
          auth_type = PAP
  }
  
  tls {
          certdir = ${confdir}/certs
          cadir = ${confdir}/certs
          private_key_password = whatever
          private_key_file = ${certdir}/server.key
          certificate_file = ${certdir}/server.pem
          CA_file = ${cadir}/ca.pem
          dh_file = ${certdir}/dh
          random_file = /dev/urandom
          CA_path = ${cadir}
          cipher_list = "DEFAULT"
          make_cert_command = "${certdir}/bootstrap"
  
          cache {
                enable = no
                max_entries = 255
          }
  
          verify {
          }
  }
  
  ttls {
          default_eap_type = md5
          copy_request_to_tunnel = no
          use_tunneled_reply = no
          virtual_server = "inner-tunnel"
  }
  
  
  peap {
          default_eap_type = mschapv2
          copy_request_to_tunnel = no
          use_tunneled_reply = no
          virtual_server = "inner-tunnel"
  }
  
  mschapv2 {
  }}
  </code></pre>
  
  <p>Also have two sites enabled, default and inner-tunnel:</p>
  
  <p>default</p>
  
  <pre><code>authorize {
      preprocess
      suffix
      eap {
          ok = return
      }
      expiration
      logintime
      ldap
  }
  authenticate {
      eap
      ldap
  }
  </code></pre>
  
  <p>inner-tunnel</p>
  
  <pre><code>authorize {
      mschap
      update control {
             Proxy-To-Realm := LOCAL
      }
      eap {
          ok = return
      }
      expiration
      ldap
      logintime
  }
  authenticate {
      Auth-Type MS-CHAP {
          mschap
      }
      eap
      ldap
  }
  </code></pre>
  
  <p>Here is a sample log I am seeing in the debug logs:</p>
  
  <p><a href="https://gist.github.com/anonymous/10483144" rel="nofollow">https://gist.github.com/anonymous/10483144</a></p>