Yes, I had thought of something to the effect of (suggestions welcomed) :
* if (!"%{ldap:ldap://master1/ou=%{client:shortname},ou=macs,dc=myorg,dc=net?cn?sub?(* *&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {* * if (!"%{ldap:ldap://master2/ou=%{client:shortname},ou=macs,dc=myorg,dc=net?c* *n?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {* * reject* * }* * }* * update {* * control:Auth-Type := Accept* * }*
But this does not account for the scenario of openldap being dead. The 1st "if" statement will be always be FALSE and never attempt the next "if" statement and therefore 'Accept'
I believe i misspoke here... But interesting observations. if i use the below code AND have multiple ldap servers configured in my ldap module, radius '%{ldap:ldap:///...}' will automatically go to the one that is alive; assuming one is at least alive. IF i have just one ldap server configured in my ldap module, (which is dead), then the 'if' will FAIL and reject as it should. *if (!"%{ldap:ldap:///ou=%{client:shortname},ou=macs,dc=datacom,dc=net?cn?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {* *reject* *}* *else {* *update {* *control:Auth-Type := Accept* *}* *}* Same results as above (ldap module will use the live ldap server, not the dead one) *if (!"%{ldap:ldap://dead-ldap-server/ou=%{client:shortname},ou=macs,dc=datacom,dc=net?cn?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}")* *...* *...* So what did i learn? you dont need to use the SRV record for failover, as long as you have all the ldap servers in your ldap module. I think it makes sense since '%{ldap:...}" is using the ldap module, technically, but i would have thought that "ldap:///" or "ldap://dead-ldap-server/" meant localhost/dead-ldap-server not "live.ldap.the-module-found' Or maybe im just completely off... Hope that makes, sense. (1) if (&NAS-Port-Type == "Ethernet" && &Calling-Station-Id) { (1) if (&NAS-Port-Type == "Ethernet" && &Calling-Station-Id) -> TRUE (1) if (&NAS-Port-Type == "Ethernet" && &Calling-Station-Id) { (1) policy rewrite_calling_station_id { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (1) --> 00-04-F2-DD-98-C6 (1) &Calling-Station-Id := 00-04-F2-DD-98-C6 (1) } # update request = noop (1) [updated] = updated (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (1) ... skipping else: Preceding "if" was taken (1) } # policy rewrite_calling_station_id = updated (1) if (!"%{ldap:ldap:///ou=%{client:shortname},ou=macs,dc=datacom,dc=net?cn?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") { rlm_ldap (ldap): Reserved connection (0) (1) Performing search in "ou=sub-macs,ou=macs,dc=myorg,dc=net" with filter "(&(objectClass=ieee802Device)(macAddress=00-04-F2-DD-98-C6))", scope "sub" (1) Waiting for search result... rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 ldap://ldap2:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) EXPAND %{ldap:ldap:///ou=%{client:shortname},ou=macs,dc=datacom,dc=net?cn?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))} (1) --> 0004f2dd98c6 (1) if (!"%{ldap:ldap:///ou=%{client:shortname},ou=macs,dc=datacom,dc=net?cn?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") -> FALSE (1) else { (1) update { (1) control:Auth-Type := Accept (1) } # update = noop (1) } # else = noop (1) } # if (&NAS-Port-Type == "Ethernet" && &Calling-Station-Id) = updated (1) ... skipping else: Preceding "if" was taken (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = Accept