I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU’s (referred to as sites) to get around issues due to the large tree size present.  This is currently working with the following setup

radiusd.conf:

modules {

            ldap srv1-sitea {

              ..

            set_auth_type = yes

            }

            ldap srv1-siteb {

              ..

            set_auth_type = yes

            }

}

sites-available/default:

authorize {

            srv1-sitea

            srv1-siteb

}

authenticate {

            Auth-Type srv1-sitea {

srv1-sitea

}

Auth-Type srv1-siteb {

srv1-siteb

}

}

Now my goal is to make this a redundant configuration.  I have duplicated my modules config, changing “srv1” to “srv2” and changing the IP address of the LDAP server.  The rest of the configuration is what is fuzzy for me.  I assume that my authorize section would be:

authorize {

            redundant {

srv1-sitea

                        srv2-sitea

            }

            redundant {

                        srv1-siteb

                        srv2-siteb

            }

Now the authentication part is where is becomes complicated.  I don’t even know where to begin with this.  I tried this based on some old configs I had used in the past, but this failed miserably:

authenticate {

       Auth-Type ldap {

                group {

                  srv1-sitea {

                    reject = 1

                    ok = return

                  }

                  srv2-siteb {

                    reject = return

                    ok = return

                  }

                }

        }

I read the “configurable failover” docs, but it is still not clear to me what I would need to do in this situation.

I am sure there is probably an easy way to accomplish this so that for each OU (“site”) it uses both LDAP servers (“srv1”,”srv2”) in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.