Maybe I missed something in the thread. But I understand '"live" LDAP server' that you want to know which LDAP server behind connection pooling, load-balancer or similar was really reached.
For this particular case I always I add the service FQDN of a particular (OpenLDAP) instance to be readable via LDAP, e.g. in the rootDSE. So a LDAP client can find out to which particular instance it connected even though it does not control the fail-over.
Thank you Michael for the input! That was a good idea! I've got it to work using the ldap SRV, which has multiple ldap servers but using the `ldapsearch` command MASTER:
sites-enabled/default *authorize {* *....* *ldap {* *fail =1* *}* *if (fail) {* *do_not_respond* *}* *if (&NAS-Port-Type == "Ethernet" && &Calling-Station-Id) {*
*rewrite_calling_station_id* *# this method was always TRUE even if the ldap server was dead* *#if (!"%{ldap:ldap://master1/ou=%{client:shortname},ou=macs,dc=datacom,dc=net?cn?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {* *if `/usr/bin/ldapsearch -x -H "ldap:///dc=test.my.org.net <http://test.my.org.net>" -b "ou=%{client:shortname},ou=macs,dc=myorg,dc=net" "(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))"` {* *update {* *control:Auth-Type := Accept* *}* *}* *else {* *reject* *}* SLAVE: *(no change)* At least with my setup, if all ldap were dead the 'fail = 1' would never allow to reach 'if NAS' where my ldapsearch is. But if 'fail /= 1', even if only 1 master ldap server is alive, then the ldapsearch would use the 'live' ldap server. (note: my ldap module has configured the IPs of the same ldap masters the SRV record resolves to) (note2: I flip the logic of 'if ldapsearch' vs 'if (!"%{ldap:ldap//...}') I could not find a way to use the '{ldap:ldap:///_ldap_srv_record...}' method, since i needed to do a subsearch. This of course makes three programs work together instead of two. (openldap + freeradius + dns). Would have been nicer to have just 2 dependents. But it is neat! Guess depends on your how you want to set it up. Going to try having the SRV record on the ldap module :D Thank you very much for the help! -dave