On 11/10/2022 23:47, Alan DeKok wrote:
On Oct 11, 2022, at 4:55 PM, Brantley Padgett via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote: Question 2 - is there a better way of handling multiple server[n]-Ldap-Group responses? Unfortunately, no. We're looking into fixing that for v4.
V3.2.x does allow you to set cache_attribue in the ldap module configuration. This is the attribute which cached group membership will be stored in when the ldap module is called in authorize (presuming appropriate settings are in place to cache group membership) If all the ldap instances are representing the same data, as would be normal in a redundant failover scenario, then it would be valid to set all instances to use the same attribute in which to cache the group membership e.g. cache_attribute = LDAP-Group Then, regardless of which ldap instance retrieves the group membership, it will be cached in the same attribute.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Nick Porter