So I’ve tried, but failed to get this working – I’m sure someone can point me in the right direction (or a sledgehammer…). So I changed mods-enabled/ldap to have two entries ldap server001 { .. } ldap server002 { .. } Modified sites-enabled/inner-tunnel to: Auth-Type LDAP { redundant-load-balance ldap { server001 server002 } } And tried variations based on finding things in the freeradius mailing lists but I can’t seem to get it working. Output from debug generally gives me: /etc/raddb/sites-enabled/inner-tunnel[157]: Failed to find "ldap" as a module or policy. /etc/raddb/sites-enabled/inner-tunnel[157]: Please verify that the configuration exists in /etc/raddb/mods-enabled/ldap. /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section. What secret sauce ingredient am I missing? I’ve tried defining, including use instantiate etc, but just can’t get a working scenario. Regards, Daniel
To my understanding for starters you would only have to do Auth-Type LDAP { redundant-load-balance { server001 server002 } } "redundant-load-balance" is right followed by the curly braces. At least it is the way it worked for me with perl modules. Am Montag, den 06.04.2020, 23:08 +0000 schrieb Daniel Oakes:
So I’ve tried, but failed to get this working – I’m sure someone can point me in the right direction (or a sledgehammer…).
So I changed mods-enabled/ldap to have two entries
ldap server001 { .. }
ldap server002 { .. }
Modified sites-enabled/inner-tunnel to:
Auth-Type LDAP {
redundant-load-balance ldap {
server001
server002
}
}
And tried variations based on finding things in the freeradius mailing lists but I can’t seem to get it working.
Output from debug generally gives me:
/etc/raddb/sites-enabled/inner-tunnel[157]: Failed to find "ldap" as a module or policy. /etc/raddb/sites-enabled/inner-tunnel[157]: Please verify that the configuration exists in /etc/raddb/mods-enabled/ldap. /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section.
What secret sauce ingredient am I missing? I’ve tried defining, including use instantiate etc, but just can’t get a working scenario.
Regards, Daniel
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Cornelius Kölbel cornelius.koelbel@netknights.it Tel:+49-151-2960-1417
NetKnights GmbH https://www.netknights.it Ludwig-Erhard-Str. 12, 34131 Kassel, Germany Tel:+49-561-3166797 Fax:+49-561-3166798 Amtsgericht Kassel HRB 16405 Geschäftsführer: Cornelius Kölbel
That didn’t work unfortunately – I think it’s because I have a lot of if statements, and they’re now all failing to expand the strings. Getting myself in a world of pain. From: Freeradius-Users <freeradius-users-bounces+daniel=2600hz.com@lists.freeradius.org> Date: Tuesday, 7 April 2020 at 11:18 AM To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Cornelius Kölbel <cornelius.koelbel@netknights.it> Subject: Re: Redundant-load-balance To my understanding for starters you would only have to do Auth-Type LDAP { redundant-load-balance { server001 server002 } } "redundant-load-balance" is right followed by the curly braces. At least it is the way it worked for me with perl modules. Am Montag, den 06.04.2020, 23:08 +0000 schrieb Daniel Oakes:
So I’ve tried, but failed to get this working – I’m sure someone can point me in the right direction (or a sledgehammer…).
So I changed mods-enabled/ldap to have two entries
ldap server001 { .. }
ldap server002 { .. }
Modified sites-enabled/inner-tunnel to:
Auth-Type LDAP {
redundant-load-balance ldap {
server001
server002
}
}
And tried variations based on finding things in the freeradius mailing lists but I can’t seem to get it working.
Output from debug generally gives me:
/etc/raddb/sites-enabled/inner-tunnel[157]: Failed to find "ldap" as a module or policy. /etc/raddb/sites-enabled/inner-tunnel[157]: Please verify that the configuration exists in /etc/raddb/mods-enabled/ldap. /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section.
What secret sauce ingredient am I missing? I’ve tried defining, including use instantiate etc, but just can’t get a working scenario.
Regards, Daniel
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Cornelius Kölbel cornelius.koelbel@netknights.it Tel:+49-151-2960-1417
NetKnights GmbH https://www.netknights.it Ludwig-Erhard-Str. 12, 34131 Kassel, Germany Tel:+49-561-3166797 Fax:+49-561-3166798 Amtsgericht Kassel HRB 16405 Geschäftsführer: Cornelius Kölbel
On Apr 6, 2020, at 7:08 PM, Daniel Oakes <daniel@2600hz.com> wrote:
So I’ve tried, but failed to get this working – I’m sure someone can point me in the right direction (or a sledgehammer…).
So I changed mods-enabled/ldap to have two entries
OK...
Modified sites-enabled/inner-tunnel to:
Good.
And tried variations based on finding things in the freeradius mailing lists but I can’t seem to get it working.
Output from debug generally gives me:
/etc/raddb/sites-enabled/inner-tunnel[157]: Failed to find "ldap" as a module or policy.
So... what's on line 157 of that file?
/etc/raddb/sites-enabled/inner-tunnel[157]: Please verify that the configuration exists in /etc/raddb/mods-enabled/ldap. /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section.
What secret sauce ingredient am I missing? I’ve tried defining, including use instantiate etc, but just can’t get a working scenario.
To do... what? Alan DeKok.
As per subject – trying to setup redundant-load-balance (or even redundant – don’t care as long as it works). Line 157 was ‘ldap’ So just wanting some redundancy in the ldap module (as I’m finding freeipa is being arse sometimes and failing to respond, so I want to go to other one of the pair). I’m going down a rabbit hole in trying to edit stanzas without understanding the implications. I ended up in a point where it got further, but now I’m not getting an expansion of the ldap group: elsif ("%{control:LDAP-Group[*]}" =~ /operations/) { etc Regards, Daniel From: Freeradius-Users <freeradius-users-bounces+daniel=2600hz.com@lists.freeradius.org> Date: Tuesday, 7 April 2020 at 12:02 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Redundant-load-balance On Apr 6, 2020, at 7:08 PM, Daniel Oakes <daniel@2600hz.com> wrote:
So I’ve tried, but failed to get this working – I’m sure someone can point me in the right direction (or a sledgehammer…).
So I changed mods-enabled/ldap to have two entries
OK...
Modified sites-enabled/inner-tunnel to:
Good.
And tried variations based on finding things in the freeradius mailing lists but I can’t seem to get it working.
Output from debug generally gives me:
/etc/raddb/sites-enabled/inner-tunnel[157]: Failed to find "ldap" as a module or policy.
So... what's on line 157 of that file?
/etc/raddb/sites-enabled/inner-tunnel[157]: Please verify that the configuration exists in /etc/raddb/mods-enabled/ldap. /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section.
What secret sauce ingredient am I missing? I’ve tried defining, including use instantiate etc, but just can’t get a working scenario.
To do... what? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 6, 2020, at 10:36 PM, Daniel Oakes <daniel@2600hz.com> wrote:
As per subject – trying to setup redundant-load-balance (or even redundant – don’t care as long as it works).
Line 157 was ‘ldap’
And you don't have an "ldap" module. So the server has no idea what to do with a bare "ldap" thing in the configuration.
So just wanting some redundancy in the ldap module (as I’m finding freeipa is being arse sometimes and failing to respond, so I want to go to other one of the pair).
I’m going down a rabbit hole in trying to edit stanzas without understanding the implications.
That won't end well...
I ended up in a point where it got further, but now I’m not getting an expansion of the ldap group:
elsif ("%{control:LDAP-Group[*]}" =~ /operations/) { etc
For various magic reasons, you can't do expansion on LDAP groups. The LDAP-Group attribute runs an LDAP group query. The LDAP-Group attribute generally does not contain all of the group information from LDAP. Alan DeKok.
Yeah – I agree – I don’t want to go down a rabbit hole. What I’m getting is this from the ldap server, which thanks to typically awful documentation is giving me this (from freeradius logs) Mon Apr 6 17:01:03 2020 : Info: rlm_ldap (ldap): Opening additional connection (4443), 1 of 1 pending slots used Mon Apr 6 17:01:03 2020 : Error: rlm_ldap (ldap): Bind was not permitted: Server was unwilling to perform Mon Apr 6 17:01:03 2020 : Error: rlm_ldap (ldap): Opening connection failed (4443) So that’s not a freeradius fault, but I’m thinking it’s the best place to deal with it. Ideally I’d like to try the other ldap server should it be returning that. Recommended approach? Daniel From: Freeradius-Users <freeradius-users-bounces+daniel=2600hz.com@lists.freeradius.org> Date: Wednesday, 8 April 2020 at 2:29 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Redundant-load-balance On Apr 6, 2020, at 10:36 PM, Daniel Oakes <daniel@2600hz.com> wrote:
As per subject – trying to setup redundant-load-balance (or even redundant – don’t care as long as it works).
Line 157 was ‘ldap’
And you don't have an "ldap" module. So the server has no idea what to do with a bare "ldap" thing in the configuration.
So just wanting some redundancy in the ldap module (as I’m finding freeipa is being arse sometimes and failing to respond, so I want to go to other one of the pair).
I’m going down a rabbit hole in trying to edit stanzas without understanding the implications.
That won't end well...
I ended up in a point where it got further, but now I’m not getting an expansion of the ldap group:
elsif ("%{control:LDAP-Group[*]}" =~ /operations/) { etc
For various magic reasons, you can't do expansion on LDAP groups. The LDAP-Group attribute runs an LDAP group query. The LDAP-Group attribute generally does not contain all of the group information from LDAP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
No it’s like it’s hitting a limit. It’s not an anonymous bind. Just every now and again both ldap servers are doing this – I’ve asked in that list about how to deal with it, as it takes the bind, then unbinds it, and repeat. After 10 mins it comes right. It’s like a connection pool, but honestly freeradius is the more configurable better documented product so I’m trying to deal with ‘that’ issue in FR. Daniel From: Freeradius-Users <freeradius-users-bounces+daniel=2600hz.com@lists.freeradius.org> Date: Thursday, 9 April 2020 at 8:40 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: RE: Redundant-load-balance
Mon Apr 6 17:01:03 2020 : Error: rlm_ldap (ldap): Bind was not permitted: Server was unwilling to perform
Sounds like the server won't accept an anonymous bind. If the bind user or passwords are wrong you'll get a different message. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 8, 2020, at 5:23 PM, Daniel Oakes <daniel@2600hz.com> wrote:
No it’s like it’s hitting a limit. It’s not an anonymous bind. Just every now and again both ldap servers are doing this – I’ve asked in that list about how to deal with it, as it takes the bind, then unbinds it, and repeat. After 10 mins it comes right.
Maybe this helps: https://www.linuxtopia.org/online_books/network_administration_guides/ldap_a...
It’s like a connection pool, but honestly freeradius is the more configurable better documented product so I’m trying to deal with ‘that’ issue in FR.
I've waited 20 years to hear that. :) But yes, we've put a lot of work into making v3 configurable and well documented. What isn't documented is the magic button which says "do everything I want, right now" Alan DeKok.
hi,
So I changed mods-enabled/ldap to have two entries
ldap server001 { .. }
ldap server002 { .. }
okay
Modified sites-enabled/inner-tunnel to:
Auth-Type LDAP {
redundant-load-balance ldap {
server001
server002
}
}
remove the ldap, its just Auth-Type LDAP { redundant-load-balance { server001 server002 } } then you need to look at the next thing thats failing. its likely because your logic is still just using 'ldap' but you're now actually server001 or server002.... alan
So what is the logic to deal with that ? An if statement wherever it referenced ldap? I have a large stanza with a elsif for matching ldap groups and returning back specific groups for a Fortinet firewall. Cheers, Daniel From: Freeradius-Users <freeradius-users-bounces+daniel=2600hz.com@lists.freeradius.org> Date: Tuesday, 7 April 2020 at 7:18 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Redundant-load-balance hi,
So I changed mods-enabled/ldap to have two entries
ldap server001 { .. }
ldap server002 { .. }
okay
Modified sites-enabled/inner-tunnel to:
Auth-Type LDAP {
redundant-load-balance ldap {
server001
server002
}
}
remove the ldap, its just Auth-Type LDAP { redundant-load-balance { server001 server002 } } then you need to look at the next thing thats failing. its likely because your logic is still just using 'ldap' but you're now actually server001 or server002.... alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan Buxey -
Alan DeKok -
Cornelius Kölbel -
Daniel Oakes -
Danner, Mearl