Franks Andy (IT Technical Architecture Manager) wrote:
- Is it worth me debugging to find out why AD is giving out referals that presumably can't be connected to, and if so how? I tried adding debug options "debug 255" and "logdir /var/log" to ldap.conf, and turning on the 0x0028 option in mods-enabled/ldap but I can't see any debugging information - any clues?
LDAPv3 referrals are under-specified broken concept anyway. Personally I'd recommend to 1. always switch of client-side referral chasing unless you're really know what you're doing 2. with MS AD point your LDAP client to the global catalog port if you have a more complex AD forest for which you provide RADIUS service @freeradius developers: IMHO the default should be chase_referrals = no in the installed configuration. chase_referrals = yes causes more issues than it solves. Ciao, Michael.