Alexei Monastyrnyi wrote:
this works as expected, though it is not that obvious that Auth-Type name refers to module name, and not just names the method...
It defines the method, but doesn't make the module set Auth-Type to that method.
Or I might have missed that from the documentation. Anyway, "fail-over" section does not reflect this IMO. Not a note of "authenticate" sub-section at all... should it be updated?
Modules having "authenticate" sections automatically have Auth-Type definitions created based on their name. This is normally the module name (i.e. LDAP), unless the module has an *instance* name, in which case it's the instance name. The LDAP module sets "Auth-Type" to it's *instance* name, not to "LDAP". That appears to be the piece you're missing. This has nothing to do with failover. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog