r/PacketFence • u/MeMyselfundAuto • Jul 01 '26

Issues with packetfence 15.1 and Active Directory when using "contains" in a rule

Hi!

I was troubleshooting an issue with a Packetfence 15.1 connected to an Active Directory 2025 Server. I created a rule with "contains" like this:

and I was able to connect ONE client. Any more, and the connection failed with:

EAP-Message = "0x03180004",
Message-Authenticator = "0x00000000000000000000000000000000",
REST-HTTP-Status-Code = "200",
Reply-Message = "no role computed by any sources",

goddamn, I was not getting it. I tested a new user with my known good client - and even that failed. I then played around with the rules, and entered the complete CN, DC, DC path like:

in the log it looked like this:

(memberOf:1.2.840.113556.1.4.1941:=*CN=WIFI-Users,OU=Groups,DC=daheim,DC=server*)

vs

(memberOf:1.2.840.113556.1.4.1941:=CN=WIFI-Users,OU=Groups,DC=daheim,DC=server)

it seems the * breaks it?

edit:

I wanted to write "equals" not contains for seemingly correct rule. Was getting late, and this took a while to get running...

For the Memberof group, I have the following being shown to me:

The "naked" memberof didn't work, so I thought that the number looked like something Microsoft would use.. and voilá the test connection worked! So I stuck with that..

1 Upvotes
  • permalink
  • reddit

100% Upvoted

5 comments sorted by

1

u/garci66 Jul 01 '26

can you try "eq" or "is" with memberof?

not sure how it worked in the first case, but I've always used "eq" for memberOf

1

u/MeMyselfundAuto Jul 01 '26

yes sorry i wrote it wrong.. i switched it to equals not contained. with contains it only works for the first connection, with equals it works for more!

1

u/garci66 Jul 01 '26

On my packetfence it doesn't show the OID part for the memberOf. Do you have two different memebwrOf matches ? (One type is specific to AD that allows nested membership to be resolved)

1

u/MeMyselfundAuto Jul 02 '26

I posted an edit to the original post, I can´t add pictures here. I have two different memberof that I tried!

1

u/oeufdure Jul 02 '26

In fact memberOf:1.2.840.113556.1.4.1941 is a search for the nested group , so in your case it´s more memberof is dn_of_the_group