On May 12, 2017, at 10:09 AM, Petar Marinkovic <highl1@gmail.com> wrote:
But, sometimes I rarely get a hickup in LDAP binding, and since the bind fail, because freeradius cannot connect to LDAP, request is rejected and user cannot connect. Usually, this is random, and if user retries authentication right away, it will get connected, but still it happens once a month.
The short answer is to keep your LDAP servers up. Poking FreeRADIUS is a bandaid, and won't fix the problem.
I've tried to follow https://wiki.freeradius.org/config/Load-balancing this to set up redundance/load balancing, but all the time for group checking, it's actually using the server I put last in the list, srom my case, it's 2nd ldap server defined in /etc/raddb/modules/ldap2
Because you configured it to check LDAP-Group, which uses a *particular* module. And doesn't do load balancing. Upgrade to v3. It will cache the group checks. That will lower the load on LDAP quite a bit. And, make FreeRADIUS less dependent on LDAP. Alan DeKok.