WLC Local EAP & LDAP authentication

chevymannie — Mon, 05 Jul 2021 12:03:07 GMT

I'm trying to get an SSID to authenticate users using local EAP with LDAP. The customer doesn't want to use a RADIUS server. I've got the LDAP server configured and when I do a debug aaa ldap enable I can see a successful bind, but the authentication fails. I get the following error:

*LDAP DB Task 1: May 12 14:44:50.714: ldapInitAndBind [1] called lcapi_init (rc = 0 - Success)
*LDAP DB Task 1: May 12 14:44:50.717: ldapInitAndBind [1] configured Method Authenticated lcapi_bind (rc = 0 - Success)
*LDAP DB Task 1: May 12 14:44:50.717: LDAP server 1 changed state to CONNECTED
*LDAP DB Task 1: May 12 14:44:50.717: disabled LDAP_OPT_REFERRALS

*LDAP DB Task 1: May 12 14:44:50.717: LDAP_CLIENT: UID Search (base=OU=Departments,DC=mydomain,DC=com, pattern=(&(objectclass=Person)(sAMAccountName=user@mydomain.com)))
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT: ldap_search_ext_s returns 0 -5
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT: Returned 1 msgs including 0 references
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT: Returned msg 1 type 0x65
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT : No matched DN
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT : Check result error 0 rc 1013
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT: Received no referrals in search result msg
*LDAP DB Task 1: May 12 14:44:50.718: LDAP_CLIENT: Received 1 attributes in search result msg
*LDAP DB Task 1: May 12 14:44:50.718: ldapAuthRequest [1] 172.16.4.30 - 389 called lcapi_query base="OU=Departments,DC=mydomain,DC=com" type="Person" attr="sAMAccountName" user="user@mydomain.com" (rc = 0 - Success)
*LDAP DB Task 1: May 12 14:44:50.718: Handling LDAP response Authentication Failed
*LDAP DB Task 1: May 12 14:44:50.718: Authenticated bind : Closing the binded session

We've verified the credentials and tried all of the options in the EAP profile? Anyone have this working that can help out? Is there something else specific I need to do on the client side?

Scenario 16: Client

mohanak — Fri, 13 May 2016 01:15:39 GMT

Scenario 16: Client authentication failed on LDAP

Debug run

debug aaa ldap enable

*LDAP DB Task 1: Feb 07 17:19:46.535: LDAP_CLIENT: Received no referrals in search result msg 
*LDAP DB Task 1: Feb 07 17:19:46.535: LDAP_CLIENT: Received 1 attributes in search result msg 
*LDAP DB Task 1: Feb 07 17:19:46.535: ldapAuthRequest [1] called lcapi_query base="CN=Users,DC=gceaaa,DC=com" type="person" attr="sAMAccountName" user="ish" (rc = 0 - Success) 
*LDAP DB Task 1: Feb 07 17:19:46.535: Handling LDAP response Authentication Failed //Failed auth
*LDAP DB Task 1: Feb 07 17:19:46.536: Authenticated bind : Closing the binded session

Workaround

Check LDAP server for reject reasons.

http://www.cisco.com/c/en/us/support/docs/wireless/5508-wireless-controller/200072-Cheat-Sheet-Common-Wireless-issues.html#anc18

topic WLC Local EAP & LDAP authentication in Wireless

WLC Local EAP & LDAP authentication

Scenario 16: Client

Scenario 16: Client authentication failed on LDAP