Hi,
Is there any way to force a logic whereby if the ldap module fails, it would drop the RADIUS request on the floor, to make it look like a service failure to the client? Kinda wrecks our resiliency model if not! We're only using a single ldap server per box, but even if we were using other ldap servers on other servers, there still is a logic whereby it may be impossible to reach any LDAP server whilst another FreeRADIUS box can reach one, but is of a lower order of preference so can't be used.
seems to be a current popular feature. if you read the mialing list archive this veyr minth theres a similar case for doing pretty much the same with SQL (insteda of your ldap). you could, perhaps not need to do this if you let each RADIUS server also talk to each LDAP. you can then configure LDAP as a failover/redundant system (see the guides/docs for doing redundant LDAP). so RADIUS1 - ldap 1, ldap 2, ldap 3 RADIUS2 - ldap 2, ldap 1, ldap 3 RADIUS3 - ldap 3, ldap 2, ldap 1 if they can share their LDAP this would be ideal... however, if not, then you'll have to use the method mentioned previously on the list - note the (fail) and return the fail attribute to the NAS rather than reject. if the NAS is good/proper, it'll try the next RADIUS itself. alan