Hi all,

I have to do a failover between 2 OpenLDAP for FreeRADIUS. I tested in Lab, and the failover works. But I have a problem, users in my ldap use group-Ldap with radiusVSA attribute for cisco. Without it, I can’t be logged on my cisco. With one of my ldap, I have the Access-Accept with cisco attribute then I can be logged, but with the other ldap, there is no cisco attribute.

Someone succeed to do a failover with 2 ldap and ldap-group ? I read post with the same problem and the solution is maybe to do a fail-over for ldap-group attribute. But I don’t understand very well how I can do it. I show you my debug.

Regards,

François

<15:42>[labobe2:/usr/local/etc/raddb]# radiusd -X

FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on May 29 2009 at 12:21:02

There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE.

You may redistribute copies of FreeRADIUS under the terms of the

GNU General Public License v2.

Starting - reading configuration files ...

including configuration file /usr/local/etc/raddb/radiusd.conf

including configuration file /usr/local/etc/raddb/proxy.conf

including configuration file /usr/local/etc/raddb/clients.conf

including files in directory /usr/local/etc/raddb/modules/

including configuration file /usr/local/etc/raddb/modules/wimax

including configuration file /usr/local/etc/raddb/modules/always

including configuration file /usr/local/etc/raddb/modules/attr_filter

including configuration file /usr/local/etc/raddb/modules/attr_rewrite

including configuration file /usr/local/etc/raddb/modules/chap

including configuration file /usr/local/etc/raddb/modules/checkval

including configuration file /usr/local/etc/raddb/modules/counter

including configuration file /usr/local/etc/raddb/modules/detail

including configuration file /usr/local/etc/raddb/modules/detail.example.com

including configuration file /usr/local/etc/raddb/modules/detail.log

including configuration file /usr/local/etc/raddb/modules/digest

including configuration file /usr/local/etc/raddb/modules/echo

including configuration file /usr/local/etc/raddb/modules/etc_group

including configuration file /usr/local/etc/raddb/modules/exec

including configuration file /usr/local/etc/raddb/modules/expiration

including configuration file /usr/local/etc/raddb/modules/expr

including configuration file /usr/local/etc/raddb/modules/files

including configuration file /usr/local/etc/raddb/modules/inner-eap

including configuration file /usr/local/etc/raddb/modules/ippool

including configuration file /usr/local/etc/raddb/modules/krb5

including configuration file /usr/local/etc/raddb/modules/ldap

including configuration file /usr/local/etc/raddb/modules/linelog

including configuration file /usr/local/etc/raddb/modules/logintime

including configuration file /usr/local/etc/raddb/modules/mac2ip

including configuration file /usr/local/etc/raddb/modules/mac2vlan

including configuration file /usr/local/etc/raddb/modules/otp

including configuration file /usr/local/etc/raddb/modules/mschap

including configuration file /usr/local/etc/raddb/modules/pam

including configuration file /usr/local/etc/raddb/modules/pap

including configuration file /usr/local/etc/raddb/modules/passwd

including configuration file /usr/local/etc/raddb/modules/perl

including configuration file /usr/local/etc/raddb/modules/policy

including configuration file /usr/local/etc/raddb/modules/preprocess

including configuration file /usr/local/etc/raddb/modules/radutmp

including configuration file /usr/local/etc/raddb/modules/realm

including configuration file /usr/local/etc/raddb/modules/smbpasswd

including configuration file /usr/local/etc/raddb/modules/smsotp

including configuration file /usr/local/etc/raddb/modules/sql_log

including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login

including configuration file /usr/local/etc/raddb/modules/sradutmp

including configuration file /usr/local/etc/raddb/modules/unix

including configuration file /usr/local/etc/raddb/modules/acct_unique

including configuration file /usr/local/etc/raddb/modules/ldap.origine

including configuration file /usr/local/etc/raddb/eap.conf

including configuration file /usr/local/etc/raddb/sql.conf

including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf

including configuration file /usr/local/etc/raddb/policy.conf

including files in directory /usr/local/etc/raddb/sites-enabled/

including configuration file /usr/local/etc/raddb/sites-enabled/default

including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel

including configuration file /usr/local/etc/raddb/sites-enabled/control-socket

group = freeradius

user = freeradius

including dictionary file /usr/local/etc/raddb/dictionary

main {

prefix = "/usr/local"

localstatedir = "/var"

logdir = "/var/log"

libdir = "/usr/local/lib/freeradius-2.1.4"

radacctdir = "/var/log/radacct"

hostname_lookups = no

max_request_time = 30

cleanup_delay = 5

max_requests = 1024

allow_core_dumps = no

pidfile = "/var/run/radiusd/radiusd.pid"

checkrad = "/usr/local/sbin/checkrad"

debug_level = 0

proxy_requests = yes

log {

stripped_names = no

auth = no

auth_badpass = no

auth_goodpass = no

}

security {

max_attributes = 200

reject_delay = 1

status_server = yes

}

radiusd: #### Loading Realms and Home Servers ####

proxy server {

retry_delay = 5

retry_count = 3

default_fallback = no

dead_time = 120

wake_all_if_all_dead = no

}

home_server localhost {

ipaddr = 127.0.0.1

port = 1812

type = "auth"

secret = "testing123"

response_window = 20

max_outstanding = 65536

require_message_authenticator = no

zombie_period = 40

status_check = "status-server"

ping_interval = 30

check_interval = 30

num_answers_to_alive = 3

num_pings_to_alive = 3

revive_interval = 120

status_check_timeout = 4

irt = 2

mrt = 16

mrc = 5

mrd = 30

}

home_server_pool my_auth_failover {

type = fail-over

home_server = localhost

}

realm example.com {

auth_pool = my_auth_failover

}

realm LOCAL {

}

radiusd: #### Loading Clients ####

client localhost {

ipaddr = 127.0.0.1

require_message_authenticator = no

secret = "testing123"

nastype = "other"

}

client 192.168.0.50 {

require_message_authenticator = no

secret = "cherche"

shortname = "swlabo"

nastype = "cisco"

}

client 192.168.0.199 {

require_message_authenticator = no

secret = "cherche"

shortname = "fwlabo"

nastype = "other"

}

client 10.96.18.4 {

require_message_authenticator = no

secret = "unixcherche"

shortname = "labobe1"

nastype = "other"

}

client 10.96.18.12 {

require_message_authenticator = no

secret = "fedoracherche"

shortname = "labobe4"

nastype = "other"

}

radiusd: #### Instantiating modules ####

instantiate {

Module: Linked to module rlm_exec

Module: Instantiating exec

exec {

wait = no

input_pairs = "request"

shell_escape = yes

}

Module: Linked to module rlm_expr

Module: Instantiating expr

Module: Linked to module rlm_expiration

Module: Instantiating expiration

expiration {

reply-message = "Password Has Expired "

}

Module: Linked to module rlm_logintime

Module: Instantiating logintime

logintime {

reply-message = "You are calling outside your allowed timespan "

minimum-timeout = 60

}

radiusd: #### Loading Virtual Servers ####

server inner-tunnel {

modules {

Module: Checking authenticate {...} for more modules to load

Module: Linked to module rlm_pap

Module: Instantiating pap

pap {

encryption_scheme = "auto"

auto_header = no

}

Module: Linked to module rlm_chap

Module: Instantiating chap

Module: Linked to module rlm_mschap

Module: Instantiating mschap

mschap {

use_mppe = yes

require_encryption = no

require_strong = no

with_ntdomain_hack = no

}

Module: Linked to module rlm_unix

Module: Instantiating unix

unix {

radwtmp = "/var/log/radwtmp"

}

Module: Linked to module rlm_eap

Module: Instantiating eap

eap {

default_eap_type = "md5"

timer_expire = 60

ignore_unknown_eap_types = no

cisco_accounting_username_bug = no

max_sessions = 2048

}

Module: Linked to sub-module rlm_eap_md5

Module: Instantiating eap-md5

Module: Linked to sub-module rlm_eap_leap

Module: Instantiating eap-leap

Module: Linked to sub-module rlm_eap_gtc

Module: Instantiating eap-gtc

gtc {

challenge = "Password: "

auth_type = "PAP"

}

Module: Linked to sub-module rlm_eap_tls

Module: Instantiating eap-tls

tls {

rsa_key_exchange = no

dh_key_exchange = yes

rsa_key_length = 512

dh_key_length = 512

verify_depth = 0

pem_file_type = yes

private_key_file = "/usr/local/etc/raddb/certs/server.pem"

certificate_file = "/usr/local/etc/raddb/certs/server.pem"

CA_file = "/usr/local/etc/raddb/certs/ca.pem"

private_key_password = "whatever"

dh_file = "/usr/local/etc/raddb/certs/dh"

random_file = "/usr/local/etc/raddb/certs/random"

fragment_size = 1024

include_length = yes

check_crl = no

cipher_list = "DEFAULT"

make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"

cache {

enable = no

lifetime = 24

max_entries = 255

}

Module: Linked to sub-module rlm_eap_ttls

Module: Instantiating eap-ttls

ttls {

default_eap_type = "md5"

copy_request_to_tunnel = no

use_tunneled_reply = no

virtual_server = "inner-tunnel"

}

Module: Linked to sub-module rlm_eap_peap

Module: Instantiating eap-peap

peap {

default_eap_type = "mschapv2"

copy_request_to_tunnel = no

use_tunneled_reply = no

proxy_tunneled_request_as_eap = yes

virtual_server = "inner-tunnel"

}

Module: Linked to sub-module rlm_eap_mschapv2

Module: Instantiating eap-mschapv2

mschapv2 {

with_ntdomain_hack = no

}

Module: Checking authorize {...} for more modules to load

Module: Linked to module rlm_realm

Module: Instantiating suffix

realm suffix {

format = "suffix"

delimiter = "@"

ignore_default = no

ignore_null = no

}

Module: Linked to module rlm_files

Module: Instantiating files

files {

usersfile = "/usr/local/etc/raddb/users"

acctusersfile = "/usr/local/etc/raddb/acct_users"

preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"

compat = "no"

}

Module: Checking session {...} for more modules to load

Module: Linked to module rlm_radutmp

Module: Instantiating radutmp

radutmp {

filename = "/var/log/radutmp"

username = "%{User-Name}"

case_sensitive = yes

check_with_nas = yes

perm = 384

callerid = yes

}

Module: Checking post-proxy {...} for more modules to load

Module: Checking post-auth {...} for more modules to load

Module: Linked to module rlm_attr_filter

Module: Instantiating attr_filter.access_reject

attr_filter attr_filter.access_reject {

attrsfile = "/usr/local/etc/raddb/attrs.access_reject"

key = "%{User-Name}"

}

modules {

Module: Checking authenticate {...} for more modules to load

Module: Linked to module rlm_ldap

Module: Instantiating ldaplabobe2

ldap ldaplabobe2 {

server = "10.96.18.10"

port = 389

password = "secret"

identity = "cn=root,dc=netplus,dc=fr"

net_timeout = 1

timeout = 1

timelimit = 1

tls_mode = no

start_tls = no

tls_require_cert = "allow"

tls {

start_tls = no

require_cert = "allow"

}

basedn = "dc=netplus,dc=fr"

filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name}))"

base_filter = "(objectclass=radiusprofile)"

auto_header = no

access_attr_used_for_allow = yes

groupname_attribute = "cn"

groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"

groupmembership_attribute = "radiusGroupName"

dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap"

ldap_debug = 0

ldap_connections_number = 5

compare_check_items = no

do_xlat = yes

set_auth_type = yes

}

rlm_ldap: Registering ldap_groupcmp for Ldap-Group

rlm_ldap: Creating new attribute ldaplabobe2-Ldap-Group

rlm_ldap: Registering ldap_groupcmp for ldaplabobe2-Ldap-Group

rlm_ldap: Registering ldap_xlat with xlat_name ldaplabobe2

rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap

rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$

rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$

rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type

rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use

rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id

rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id

rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password

rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password

rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password

rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password

rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password

rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT

rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration

rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address

rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type

rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol

rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address

rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask

rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route

rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing

rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id

rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU

rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression

rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host

rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service

rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port

rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number

rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id

rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network

rlm_ldap: LDAP radiusClass mapped to RADIUS Class

rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout

rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout

rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action

rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service

rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node

rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group

rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link

rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network

rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone

rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit

rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port

rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message

rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair

conns: 0x28523420

Module: Instantiating ldaplabobe1

ldap ldaplabobe1 {

server = "10.96.18.4"

port = 389

password = "secret"

identity = "cn=root,dc=netplus,dc=fr"

net_timeout = 1

timeout = 1

timelimit = 1

tls_mode = no

start_tls = no

tls_require_cert = "allow"

tls {

start_tls = no

require_cert = "allow"

}

basedn = "dc=netplus,dc=fr"

filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name}))"

base_filter = "(objectclass=radiusprofile)"

auto_header = no

access_attr_used_for_allow = yes

groupname_attribute = "cn"

groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"

groupmembership_attribute = "radiusGroupName"

dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap"

ldap_debug = 0

ldap_connections_number = 5

compare_check_items = no

do_xlat = yes

set_auth_type = yes

}

rlm_ldap: Registering ldap_groupcmp for Ldap-Group

rlm_ldap: Creating new attribute ldaplabobe1-Ldap-Group

rlm_ldap: Registering ldap_groupcmp for ldaplabobe1-Ldap-Group

rlm_ldap: Registering ldap_xlat with xlat_name ldaplabobe1