Re: Re: LDAP redundant with LDAP-Group within users file
Problem: radius is using always the same ldap server for group extends. If this (one!) server fails, radius authentication is not possible. Very bad, because we have "redundancy" configured, and expected to have zero outage.
Sorry. The "ldap" module and FreeRADIUS do not work that way. "LDAP-Group" is a virtual attribute, that is registered by the first LDAP module to be created; it can't "fail over". It doesn't know about "redundant {}" or similar.
OK, thanks for detailed answer. I read in other threads ansers that already point to that fact.
Defining all three server whithin one section in modules/ldap
ldap { server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" .}
And setting just "ldap" within authorize and authenticate:
With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected)
It should not take 15 minutes.
What is your "net_timeout" set to?
net_timeout = 1 timelimit = 2 timeout = 4 For testing i added a hostroute to an other gateway (=host unreachable)
Unfortunately, when you supply >1 LDAP server, this is handled internally by libldap, and libldap tries the LDAP servers in series, not in parallel. So there will always be some outage.
As i wrote in my first post, short outage would be ok, but 15 minutes was too much. I added the hostroute to the server that opend the first connection when a request came in (i thought that this is the call regarding ldap-group). That was normaly the last from the list (server=...). I made serveral requests, but all end with "server unreachable / reject". But i could see in tcpdump, that after 15 minutes a lot of connections to an other ldap server were opend.
From this moment, all new requests were successfull, to an other ldap.
FreeRADIUS does not currently have connection pools, and they're a bit hard with LDAP because libldap doesn't have a great API.
I found mails regarding similar problems within the archive, but no suitable solution. (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.h... from 2006)
Is there a solution for reducing the outage and having loadbalancing for our case?
At the moment, the "ldap" module does not have the kind of instant failover you're looking for. You will need some kind of IP loadbalancing solution in front of your LDAP servers to achieve this.
Not as easy as it sounds ;-) 12 radius pairs (singe server with the same config) at 10 locations, 3 ldap server at 3 different locations For countervail lost of one or two locations, loadbalancing will be very complex.
On 06/29/2011 03:46 PM, Jan.Gnepper@t-systems.com wrote:
What is your "net_timeout" set to?
net_timeout = 1 timelimit = 2 timeout = 4
For testing i added a hostroute to an other gateway (=host unreachable)
Unfortunately, when you supply>1 LDAP server, this is handled internally by libldap, and libldap tries the LDAP servers in series, not in parallel. So there will always be some outage.
As i wrote in my first post, short outage would be ok, but 15 minutes was too much.
Ok. As I say, it definitely shouldn't take that long. libldap should take at most net_timeout*N where N is the number of servers you have in your: server = "a.b.c.d x.y.z.w" ...line. I will try to test this. What OS are you on, and what LDAP libraries & version of those libs are you using?
Not as easy as it sounds ;-) 12 radius pairs (singe server with the same config) at 10 locations, 3 ldap server at 3 different locations For countervail lost of one or two locations, loadbalancing will be very complex.
Sure. People are looking into better LDAP failover in "redundant {}" stanzas. LDAP-Group is a bit harder though.
Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Not as easy as it sounds ;-) 12 radius pairs (singe server with the same config) at 10 locations, 3 ldap server at 3 different locations For countervail lost of one or two locations, loadbalancing will be very complex.
If the three sites have an IGP running between them (OSPF, EIGRP, iBGP, ISIS, whatever) then you can anycast the ldap servers. No single point of failure and cheap to do. <self-promo> http://www.digriz.org.uk/ha-ospf-anycast </self-promo> It does not have a LDAP example, but you can trivially take the RADIUS or DNS probe and modify it to use ldapsearch.
Sure.
People are looking into better LDAP failover in "redundant {}" stanzas. LDAP-Group is a bit harder though.
A quick hack would be to use rlm_exec if you do not have have a high RADIUS packet rate, the alternative would be rlm_perl/rlm_python. I'm happy to put something like this together as we could benefit from it. I envision it working by in the users file you fill up an attribute (say, 'Foobar-Ldap-Group') with the group checks you want to make and an Accept[1]. The module would check for the presence of the attribute, and Ldap-User-Dn (if not, be a noop) and flip the Accept to Reject if things do not work out. Another ways would be to pass an LDAP filter from user/unlang in a similar manner (multi-value attribute that's concatinated). It would at least take the presure off needing LDAP-Group to be redundant today. Cheers [1] for use, we have typically use the following type of thing (or it's inverse with a follow through clause): Huntgroup == foo, Ldap-Group == cheesy, Auth-Type := Accept Huntgroup == foo, Ldap-Group == chips, Auth-Type := Accept Huntgroup == foo, Auth-Type := Reject -- Alexander Clouter .sigmonster says: Don't compare floating point numbers solely for equality.
participants (3)
-
Alexander Clouter -
Jan.Gnepper＠t-systems.com -
Phil Mayers