Re: [PacketFence-users] No role computed by any sources

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hello Adrian,

your issue is just because you use sAMAccountName as user attribute and 
it should be servicePrincipalName.

Regards

Fabrice

Le 21-02-17 à 03 h 59, Adrian Dessaigne via PacketFence-users a écrit :
> Hello Fabrice,
>
> Here is a log for one host. It does repeat with the same infos for 
> other hosts on later authentication :
>
> Feb 17 08:34:44 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] handling radius autz request: from 
> switch_ip => (@switchIP), connection_type => Ethernet-EAP,switch_mac 
> => (50:06:ab:89:d0:08), mac => [f8:b4:6a:ae:4a:3d], port => 50308, 
> username => "host/PC191102.domain.local" (pf::radius::authorize)
> Feb 17 08:34:44 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] is doing machine auth with account 
> 'host/PC191102.domain.local'. (pf::radius::authorize)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Instantiate profile 802.1X 
> (pf::Connection::ProfileFactory::_from_profile)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Found authentication source(s) : 
> 'SourceAD1' for realm 'domain.local' 
> (pf::config::util::filter_authentication_sources)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Using sources SourceAD1 for matching 
> (pf::authentication::match2)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> WARN: [mac:f8:b4:6a:ae:4a:3d] [SourceAD1 CatchAll] Searching for 
> (sAMAccountName=host/PC191102.domain.local), from 
> OU=BRESTAIM-Utilisateurs,DC=sopab,DC=fr, with scope sub 
> (pf::Authentication::Source::LDAPSource::match_in_subclass)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] LDAP testing connection 
> (pf::LDAP::expire_if)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> ERROR: [mac:f8:b4:6a:ae:4a:3d] Error binding: 'Connexion 
> ré-initialisée par le correspondant' (pf::LDAP::log_error_msg)
> Feb 17 08:34:45 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> WARN: [mac:f8:b4:6a:ae:4a:3d] LDAP connection expired 
> (pf::LDAP::expire_if)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> ERROR: [mac:f8:b4:6a:ae:4a:3d] Error connecting to domain.local:389 
> using encryption none (pf::LDAP::compute_connection)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> WARN: [mac:f8:b4:6a:ae:4a:3d] [SourceAD1] Unable to connect to 
> domain.local (pf::Authentication::Source::LDAPSource::_connect)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> ERROR: [mac:f8:b4:6a:ae:4a:3d] [SourceAD1] Unable to connect to any 
> LDAP server (pf::Authentication::Source::LDAPSource::_connect)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] No rules matches or no category defined 
> for the node, set it as unreg. (pf::role::getNodeInfoForAutoReg)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> WARN: [mac:f8:b4:6a:ae:4a:3d] No category computed for autoreg 
> (pf::role::getNodeInfoForAutoReg)
>
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Found authentication source(s) : 
> 'SourceAD1' for realm 'domain.local' 
> (pf::config::util::filter_authentication_sources)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Role has already been computed and we 
> don't want to recompute it. Getting role from node_info 
> (pf::role::getRegisteredRole)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Username was defined 
> "host/PC191102.domain.local" - returning role 'default' 
> (pf::role::getRegisteredRole)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] PID: "host/PC191102.domain.local", 
> Status: reg Returned VLAN: (undefined), Role: default 
> (pf::role::fetchRoleForNode)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> WARN: [mac:f8:b4:6a:ae:4a:3d] No parameter defaultVlan found in 
> conf/switches.conf for the switch @switchIP (pf::Switch::getVlanByName)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] security_event 1300003 force-closed for 
> f8:b4:6a:ae:4a:3d (pf::security_event::security_event_force_close)
> Feb 17 08:34:46 SVPACKETFENCE packetfence_httpd.aaa: httpd.aaa(2122) 
> INFO: [mac:f8:b4:6a:ae:4a:3d] Instantiate profile 802.1X 
> (pf::Connection::ProfileFactory::_from_profile)
>
> Look like I have AD issues ...
> However, when looking in the AD logs, I see the creditential 
> validation for the computer " PC191102.domain.local" and all 
> PacketFence related queries are in "Success".
> We do have multiple DC under the DN, should I use an IP address 
> instead in my configuration ?
>
> Regards,
> Adrian.
>
> ------------------------------------------------------------------------
> *De: *"packetfence-users" <pac...@li...>
> *À: *"packetfence-users" <pac...@li...>
> *Cc: *"Durand fabrice" <fd...@in...>
> *Envoyé: *Mercredi 17 Février 2021 03:42:02
> *Objet: *Re: [PacketFence-users] No role computed by any sources
>
> Hello Andrian,
>
> can you share the packetfence.log file when you try to connect ?
>
> Regards
>
> Fabrice
>
>
> Le 21-02-16 à 11 h 12, Adrian Dessaigne via PacketFence-users a écrit :
>
>     Hi everyone,
>
>     I'm slowly integrating PacketFence on a new infrastrucutre. I've
>     configured everything as shown in the documentation and with my
>     personnal experience.
>     However, I'm facing a small issues and it look random.
>
>     I have an authentication source pointing on the "Computer OU" to
>     do computer auth.
>     Some connect without any issues, the device get auto registered,
>     get the good role etc etc.
>     But some computer won't connect at all, it get rejected with the
>     Reply-Message = "no role computed by any sources"
>     I got one case, I just had to shut and no shut the port on the
>     switch :
>     Between these two frames, the hosts was trying to authenticate via
>     MAB.
>
>     The weird thing is, it's the same authentication source and all
>     computers are in the same OU.
>
>     Domain is joined, REALMs are configured with the only domain
>     available.
>     Connexion profil filters :
>     Any
>     Connexion type : Ethernet-EAP
>     Sources : Devices Source
>
>     Authentication sources config :
>     Base DN : OU=Computer,DC=domain,DC=fr
>     Attribute : servicePrincipalName
>     Filter :
>     Any
>     No conditions
>     Action : Role : default
>     Access duration : 12h
>
>     I've also tryed with "Role On Not Found, I have the same issue".
>
>     Any tough on that ?
>
>     Thanks for your help,
>     Adrian.
>     //
>     EnregistrerEnregistrer
>
>
>     _______________________________________________
>     PacketFence-users mailing list
>     Pac...@li...
>     https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
>
> _______________________________________________
> PacketFence-users mailing list
> Pac...@li...
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
> _______________________________________________
> PacketFence-users mailing list
> Pac...@li...
> https://lists.sourceforge.net/lists/listinfo/packetfence-users