Hi,
Two separate, previously reported bugs in /etc/univention/templates/files/etc/freeradius/3.0/sites-available/default are still present in the currently shipped UCS template, even though both issues were already reported, diagnosed, and fixed by community members, just in threads that have since been closed:
1. Case-insensitive hostname rewrite breaks memberUid lookups
Reported here: Problem: FreeRADIUS rewrites machine hostnames to lowercase and breaks LDAP lookups (auto-closed after 24h, references Bug 58914)
The machine-account rewrite uses tolower() on the entire User-Name before extracting the hostname, which then fails to match a case-sensitive memberUid entry (e.g. PC-01$) whenever the actual hostname contains uppercase letters, the default case for Windows computer names.
Confirmed fix from that thread:
if ("%{request:User-Name}" =~ /(?i)^host\/(.*)\.example.intranet/) {
update request {
User-Name := "%{1}$"
}
}
2. Domain-prefixed User-Name (DOMAIN\username) breaks both the user-existence check and the group/VLAN memberUid lookup
Reported here: Issue with VLAN Assignment during 802.1x Authentication in RADIUS (Incorrect LDAP Query)
When a Windows client authenticates with domain-prefixed credentials, %{User-Name} still contains the DOMAIN\ prefix at the point it’s used in LDAP filters. This affects two separate lines in the template (not just one), both the initial uid existence check and, independently, the memberUid group/VLAN lookup further down (with a third occurrence in the MAC-Authentication-Bypass branch, if freeradius/conf/allow-mac-address-authentication is enabled).
Fix: replace %{User-Name} with %{%{Stripped-User-Name}:-%{User-Name}} in all affected lines. The :- fallback is important, using %{Stripped-User-Name} alone breaks machine authentication (host/PC-01...), since Stripped-User-Name is only populated for domain-prefixed logins.
Confirmation
Both fixes tested and confirmed working in our environment (UCS 5.2-6) for user-based and computer-based dynamic VLAN assignment.
Given that both original threads are now closed and the underlying template still hasn’t been updated, could this get tracked/fixed upstream in the univention-radius package rather than requiring every UCS admin to independently rediscover and patch this?