pfSense Support Subscription

Author Topic: IPsec + ldap xauth  (Read 1178 times)

0 Members and 1 Guest are viewing this topic.

Offline nataans

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
IPsec + ldap xauth
« on: May 26, 2012, 09:14:15 am »
Hello all,

I have been testing IPsec on the latest snapshot (built on Fri May 25 18:38:27 EDT 2012 ) and when I set user authentication source to 'LDAP', racoon service seems to fail to start. The logs show the following:

racoon: ERROR: /var/etc/racoon.conf:25: "ldapcfg" racoon not configured with --with-libldap

I have read some older posts regards ldap authentication and people seem to think that racoon has been compiled with ldap option. Can anyone share their thoughts who are experts in this area.

Many thanks,

Andris

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14976
  • Karma: +4/-0
    • View Profile
Re: IPsec + ldap xauth
« Reply #1 on: May 26, 2012, 09:49:55 am »
There was never any proper backend code for IPsec to auth against Radius or LDAP.

We are changing it before 2.1 ships, there's an open ticket yet. There will be a script (like how openvpn does it) so that racoon doesn't need direct knowledge of radius or ldap, it'll call our script and let our script decide if a user is OK or not.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline mattderk

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: IPsec + ldap xauth
« Reply #2 on: July 24, 2012, 09:02:50 am »
I saw in the latest beta build of 2.1 (July 22nd 2012 I think) Xauth LDAP options for ipsec tunnels.  When set it seems to fail.  Should Xauth and LDAP in ipsec work ?

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14976
  • Karma: +4/-0
    • View Profile
Re: IPsec + ldap xauth
« Reply #3 on: July 26, 2012, 02:14:08 pm »
No, it doesn't work right now.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!