FreeRADIUS with Google Secure LDAP connectivity issues

[itschriss]

I’m working on implementing a solution in which I’m going to use FreeRADIUS with Google Secure LDAP to authenticate Unifi WPA2 Enterprise WiFi users. The problem I’m facing is that FreeRADIUS can’t bind to Google’s LDAPS server, however, when using ldapsearch I can successfully retrieve data from it.

Here’s my ldap configuration file contents:

---

ldap {
server = ‘ldaps://ldap.google.com’
port = 636
identity = ‘REMOVED’
password = REMOVED
base_dn = ‘dc=REMOVED,dc=com’
}

TLS section as follows:

---

tls {
start_tls = no
certificate_file = /etc/freeradius/3.0/certs/ldap.crt
private_key_file = /etc/freeradius/3.0/certs/ldap.key
}

The above entries are exactly the same as the ones I’m using with ldapsearch. I should add, that I’m using an Ubuntu 24.04.1 AWS image (the firewall rules are updated accordingly) and following this nifty guide > https://nasirhafeez.splashnetworks.co/freeradius-with-google-g-suite-workspace-secure-ldap-for-wpa2-enterprise-wifi/. Any help would be much appreciated!

[spiceuser-guvma]

Did you ever make progress with this? I’m hitting the same wall.

[itschriss]

Yes. At first, I thought that FreeRadius couldn’t bind with Google LDAPS but it ended up being something completely different. In my case, debug mode was saying this:

rlm_ldap (ldap): Waiting for bind result...
ber_get_next failed, errno=11.

So I wrongly assumed that the bind didn’t happened. In reality, the configuration was correct, but the prompts I sent for testing using radtest were wrong.

What is the issue you’re facing? Perhaps I might be able to help.

[slopez8]

I just ran into the same thing. It took me a few minutes before I realized I never enabled the service on the Google side of things.

Once I turned it on inside Google Workspace, it worked as expected when I ran systemctl restart freeradius.

Hopefully you already figured that out (if the same issue) and if not, hopefully this helps others.