Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captive Portal Error

    Captive Portal
    3
    24
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      AYSMAN
      last edited by

      Hi,
      has anyone encountered this particular issue with Freeradius3 0.15.7_27 with MySQL when a user tries to authenticate using username/password
      "(0) Login incorrect (Failed retrieving values required to evaluate condition): [myuser/mypassword] (from client Firewall.pfsense port 0)"

      I have other deployments of pfsense with freeradius and mysql authentication using the exact same config. which are working fine. The only difference i see is the freeradius package version in pfsense which is 0.15.7_20.

      Thanks in Advance

      viktor_gV 1 Reply Last reply Reply Quote 0
      • viktor_gV
        viktor_g Netgate @AYSMAN
        last edited by

        @aysman Please update FreeRADIUS pkg to the latest version
        see https://redmine.pfsense.org/issues/11054#note-4

        A 1 Reply Last reply Reply Quote 0
        • A
          AYSMAN @viktor_g
          last edited by

          @viktor_g said in Captive Portal Error:

          https://redmine.pfsense.org/issues/11054#note-4

          Hi @viktor_g Thanks for your reply. I'm already using the latest version 0.15.7_27 from the pfsense package list

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @AYSMAN
            last edited by

            @aysman

            To see all the details, also why thing go wrong :
            Stop Radius in the GUI.
            Open a console or SSH, option 8.
            Type

            radiusd -X

            Enjoy.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            A 1 Reply Last reply Reply Quote 0
            • A
              AYSMAN @Gertjan
              last edited by

              Hi @gertjan Here's the debug log i got

              Ready to process requests

              (0) Received Access-Request Id 98 from 172.16.100.1:12399 to 172.16.100.1:1812 length 162
(0)   Service-Type = Login-User
(0)   User-Name = "SERVO"
(0)   User-Password = "SERVO"
(0)   NAS-IP-Address = 172.16.100.1
(0)   NAS-Identifier = "CaptivePortal-guestwifi"
(0)   Calling-Station-Id = "a2:e2:c9:cb:1b:d5"
(0)   Called-Station-Id = "00:e0:4c:62:fa:80:ServoOffice.firewall.ph"
(0)   NAS-Port-Type = Ethernet
(0)   NAS-Port = 2018
(0)   Framed-IP-Address = 172.16.100.2
(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(0)   authorize {
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "SERVO", skipping NULL due to config.
(0)     [suffix] = noop
(0) ntdomain: Checking for prefix before "\"
(0) ntdomain: No '\' in User-Name = "SERVO", skipping NULL due to config.
(0)     [ntdomain] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0)     if ((notfound || noop) && (&control:Auth-Type != Accept)) {
(0)     ERROR: Failed retrieving values required to evaluate condition
(0) dailycounter: WARNING: Couldn't find check attribute, control:Max-Daily-Session, doing nothing...
(0)     [dailycounter] = noop
(0) monthlycounter: WARNING: Couldn't find check attribute, control:Max-Monthly-Session, doing nothing...
(0)     [monthlycounter] = noop
(0) noresetcounter: WARNING: Couldn't find check attribute, control:Max-All-Session, doing nothing...
(0)     [noresetcounter] = noop
(0) expire_on_login: WARNING: Couldn't find check attribute, control:Expire-After, doing nothing...
(0)     [expire_on_login] = noop
(0)     if (&request:Calling-Station-Id == &control:Calling-Station-Id) {
(0)     ERROR: Failed retrieving values required to evaluate condition
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type
(0) pap: WARNING: Authentication will fail unless a "known good" password is available
(0)     [pap] = noop
(0)   } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0)     redundant sql {
(0) sql1: EXPAND .query
(0) sql1:    --> .query
(0) sql1: Using query template 'query'
rlm_sql (sql1): Reserved connection (1)
(0) sql1: EXPAND %{User-Name}
(0) sql1:    --> SERVO
(0) sql1: SQL-User-Name set to 'SERVO'
(0) sql1: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
(0) sql1:    --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'SERVO', 'SERVO', 'Access-Reject', '2021-02-09 14:55:43')
(0) sql1: EXPAND /var/log/sqltrace.sql
(0) sql1:    --> /var/log/sqltrace.sql
(0) sql1: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'SERVO', 'SERVO', 'Access-Reject', '2021-02-09 14:55:43')
(0) sql1: SQL query returned: success
(0) sql1: 1 record(s) updated
rlm_sql (sql1): Released connection (1)
(0)       [sql1] = ok
(0)     } # redundant sql = ok
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> SERVO
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Login incorrect (Failed retrieving values required to evaluate condition): [SERVO/SERVO] (from client ServoOffice.firewall.ph port 2018 cli a2:e2:c9:cb:1b:d5)
(0) Delaying response for 1.000000 seconds
Waking up in 0.2 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 98 from 172.16.100.1:1812 to 172.16.100.1:12399 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 98 with timestamp +21
Ready to process requests
              GertjanG 2 Replies Last reply Reply Quote 0
              • GertjanG
                Gertjan @AYSMAN
                last edited by

                This is the part you should look up :

                @aysman said in Captive Portal Error:

                (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
                (0) pap: WARNING: Authentication will fail unless a "known good" password is available

                Btw : The mysql communication works.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                A 1 Reply Last reply Reply Quote 0
                • A
                  AYSMAN @Gertjan
                  last edited by

                  Hi @gertjan
                  Yes, I think Mysql Integration works too. I've tried to google that error message but haven't found any solid resolution yet. My other pfsense + radius + mysql deployments with the exact same config works only this particular version of freeradius package encounters this error

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @AYSMAN
                    last edited by

                    Another one :

                    @aysman said in Captive Portal Error:

                    ERROR: Failed retrieving values required to evaluate condition

                    this is the one where the user is found / identified, when I'm seeing this :

                    (17) eap: No EAP-Message, not doing EAP
                    (17) [eap] = noop
                    (17) files: users: Matched entry DEFAULT at line 1
                    (17) files: users: Matched entry x at line 388
                    (17) [files] = ok

                    Instead of your :

                    (0) eap: No EAP-Message, not doing EAP
                    (0) [eap] = noop
                    (0) [files] = noop

                    I'm using the GUI Package > FreeRADIUS : Users > Users page to enter my users.
                    You are using, I guess, something diffferent ?
                    It looks like Freeradius can't access you 'list with users'.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    A 2 Replies Last reply Reply Quote 0
                    • A
                      AYSMAN @Gertjan
                      last edited by

                      @gertjan I'm Using MySQL as database that contain my list of users including user attributes. Not an expert reading these logs correct me if Im wrong, but from what I understand is that freeradius is "ignoring" the myqsl connection for the users

                      1 Reply Last reply Reply Quote 0
                      • A
                        AYSMAN @Gertjan
                        last edited by

                        Hi @gertjan just to counter check, I tried using freeradius3 + MySQL as backend hosted in my ubuntu server then configure pfsense captive portal to authenticate users to my external freeradius server, everything works fine.

                        viktor_gV GertjanG 2 Replies Last reply Reply Quote 0
                        • viktor_gV
                          viktor_g Netgate @AYSMAN
                          last edited by

                          @aysman Try to create 'dumb' user on the FreeRADIUS / Users page and check again with radiusd -X

                          A 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @AYSMAN
                            last edited by Gertjan

                            That's what I'm using :
                            FreeRadius 0.15.7_27 and a MariaDB (== a mysql variant) on a server on my LAN to authentify captive portal users.

                            I never used this :

                            3a20b80b-16c9-40ed-b8ab-c80dde76d99d-image.png

                            @viktor_g said in Captive Portal Error:

                            Try to create 'dumb' user on the FreeRADIUS / Users page and check again with radiusd -X

                            Info : This "dumb" user will get stored in a file /usr/local/etc/raddb/mods-config/files/authorize (not the database).

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            viktor_gV 1 Reply Last reply Reply Quote 0
                            • viktor_gV
                              viktor_g Netgate @Gertjan
                              last edited by viktor_g

                              @aysman Please check this:

                              1. killall radiusd
                              2. open /usr/local/etc/raddb/sites-enabled/default
                                and replace if ((notfound || noop) && (&control:Auth-Type != Accept)) {
                                with if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
                              3. run radiusd -X and check authentication again
                              GertjanG A 2 Replies Last reply Reply Quote 1
                              • GertjanG
                                Gertjan @viktor_g
                                last edited by

                                @viktor_g

                                This works ..... but :
                                I had to :

                                #	files
#	if ((notfound || noop) && (&control:Auth-Type != Accept)) {
	if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {

                                => I exclude 'files' altogether.
                                Now the 'radcheck' table is questionned :

                                (0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
(0)     EXPAND %{%{Control:Auth-Type}:-No-Accept}
(0)        --> No-Accept
(0)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))  -> TRUE
(0)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))  {
(0)       redundant sql {
(0) sql1: EXPAND %{User-Name}
(0) sql1:    --> test
(0) sql1: SQL-User-Name set to 'test'
rlm_sql (sql1): Reserved connection (1)
(0) sql1: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql1:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id
(0) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id
(0) sql1: User found in radcheck table
(0) sql1: Conditional check items matched, merging assignment check items
(0) sql1:   Cleartext-Password := "test"
(0) sql1: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql1:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id
(0) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id
rlm_sql (sql1): Reserved connection (2)
rlm_sql (sql1): Released connection (2)
(0) sql1: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(0) sql1:    --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority
(0) sql1: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority
(0) sql1: User not found in any groups
rlm_sql (sql1): Released connection (1)
(0)         [sql1] = ok
(0)       } # redundant sql = ok
(0)       if (notfound || noop) {
(0)       if (notfound || noop)  -> FALSE
(0)     } # if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))  = ok

                                I had a 'test' user set up :

                                e1be4832-76c8-4166-a0d5-88a960ed621c-image.png

                                With

                                files

                                in place,
                                your

                                if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))

                                yields a "FALSE, so the 'sql' block isn't executed.

                                (that what I make of it).

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                viktor_gV 1 Reply Last reply Reply Quote 0
                                • viktor_gV
                                  viktor_g Netgate @Gertjan
                                  last edited by

                                  @gertjan said in Captive Portal Error:

                                  With
                                  files

                                  in place,
                                  your
                                  if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))

                                  yields a "FALSE, so the 'sql' block isn't executed.
                                  (that what I make of it).

                                  This is correct because it finds the "test" user in the files backend.
                                  It checks files, sql and ldap backends sequentially.

                                  Redmine issue created: https://redmine.pfsense.org/issues/11388

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @viktor_g
                                    last edited by

                                    @viktor_g said in Captive Portal Error:

                                    This is correct because it finds the "test" user in the files backend.

                                    I did not (do not) have a 'test' user set up in the pfSense GUI - only in the 'radcheck' MYSQL table.

                                    Done on purpose, to see if the auth would fall through to 'radcheck testing' if no result was found in the 'files' (pfSense GUI).

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    viktor_gV 1 Reply Last reply Reply Quote 0
                                    • viktor_gV
                                      viktor_g Netgate @Gertjan
                                      last edited by

                                      @gertjan in this case it should bypass files backend,
                                      my test (raduser1 in ldap backend, test1 user in files backend) with this patch:

                                      raduser1 (ldap):

                                      (0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
(0)     EXPAND %{%{Control:Auth-Type}:-No-Accept}
(0)        --> No-Accept
(0)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))  -> TRUE
(0)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))  {
(0)       if (true) {
(0)       if (true)  -> TRUE
(0)       if (true)  {
(0)         redundant {
rlm_ldap (ldap): 0 of 0 connections in use.  You  may need to increase "spare"
rlm_ldap (ldap): Opening additional connection (0), 1 of 5 pending slots used
rlm_ldap (ldap): Connecting to ldap://192.168.88.91:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Reserved connection (0)
(0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(0) ldap:    --> (uid=raduser1)
(0) ldap: Performing search in "cn=accounts,dc=pand,dc=int" with filter "(uid=raduser1)", scope "sub"
(0) ldap: Waiting for search result...
(0) ldap: User object found at DN "uid=raduser1,cn=users,cn=accounts,dc=pand,dc=int"
(0) ldap: Processing user attributes
(0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
(0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
rlm_ldap (ldap): Released connection (0)
Need 4 more connections to reach min connections (5)
rlm_ldap (ldap): Opening additional connection (1), 1 of 4 pending slots used
rlm_ldap (ldap): Connecting to ldap://192.168.88.91:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(0)           [ldap] = ok

                                      test1 (files):

                                      1) eap: No EAP-Message, not doing EAP
(1)     [eap] = noop
(1) files: users: Matched entry test1 at line 2
(1)     [files] = ok
(1)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
(1)     if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept"))  -> FALSE
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
(1)     [daily] = noop
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
(1)     [weekly] = noop
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
(1)     [monthly] = noop
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
(1)     [forever] = noop
(1)     if (&request:Calling-Station-Id == &control:Calling-Station-Id) {
(1)     ERROR: Failed retrieving values required to evaluate condition
(1)     [expiration] = noop
(1)     [logintime] = noop
(1)     [pap] = updated
(1)   } # authorize = updated
                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @viktor_g
                                        last edited by

                                        @viktor_g :

                                        Wait : your logs handle a 'files' and/or 'ldap'.
                                        I'm using 'files' and 'sql1' (using the table 'radcheck' etc).

                                        @AYSMAN didn't mention 'ldap'.

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        viktor_gV 1 Reply Last reply Reply Quote 0
                                        • viktor_gV
                                          viktor_g Netgate @Gertjan
                                          last edited by

                                          @gertjan Yes, but it uses the same logic (see /usr/local/etc/raddb/sites-enabled/default)

                                          files + ldap:

                                          if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
                        ### sql DISABLED ###
        if (true) {                     
          redundant {
          ldap
          # this line adds ldap2 when activated
         ### ldap2 disabled ###
        }
    if (notfound || noop) {
          reject
    }
 }
}

                                          files + sql:

                                          if ((notfound || noop) && ("%{%{Control:Auth-Type}:-No-Accept}" != "Accept")) {
         redundant sql {
                sql1
                ### sql2 DISABLED ###
        }
        if (notfound || noop) {
                        ### ldap ###
                        if (notfound || noop) {
                                reject
                       }
        }
 }
                                          A 1 Reply Last reply Reply Quote 0
                                          • A
                                            AYSMAN @viktor_g
                                            last edited by

                                            @viktor_g Already tested this, Its working just fine with no errors

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.