Is it possible for the module to do DNS discovery of the available ldap servers? I created a srv record for my ldap servers which im able to resolve. # domain amer.nwk.jwm2.net _ldap._tcp SRV 0 1 389 my-ldap-server1 _ldap._tcp SRV 0 2 389 my-ldap-server2 _ldap._tcp SRV 0 3 389 my-ldap-server3 $ host -t srv _ldap._tcp.amer _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 3 389 my-ldap-server3.amer.nwk.jwm2.net. _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 2 389 my-ldap-server2.amer.nwk.jwm2.net. _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 1 389 my-ldap-server1.amer.nwk.jwm2.net. $ ldapsearch -LLL -H "ldap:///dc%3Damer.nwk.jwm2.net" -b dc=datacom,dc=net -D "cn=manager,dc=datacom,dc=net" -w '<pass>' uid=config dn: uid=config,ou=People,dc=datacom,dc=net uid: config cn: ECR user givenName: ECR ... ... Thanks! -dave
On Oct 11, 2017, at 10:18 AM, Dave Macias <davama@gmail.com> wrote:
Is it possible for the module to do DNS discovery of the available ldap servers?
No. DNS can take up to 30s to time out when things go wrong. The server needs to be able to find things quickly. Alan DeKok.
Can that be a supportablility decision left to the implementer? The SSSD project has a nifty config option that allows for dns srv queries and statically configured hosts. Combine that with an application specific timeout option and you can have the best of all options On Oct 11, 2017 10:50 AM, "Alan DeKok" <aland@deployingradius.com> wrote:
On Oct 11, 2017, at 10:18 AM, Dave Macias <davama@gmail.com> wrote:
Is it possible for the module to do DNS discovery of the available ldap servers?
No.
DNS can take up to 30s to time out when things go wrong. The server needs to be able to find things quickly.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Oct 11, 2017, at 1:11 PM, brendan kearney <bpk678@gmail.com> wrote:
Can that be a supportablility decision left to the implementer?
Sure. Feel free to send a patch which adds this functionality.
The SSSD project has a nifty config option that allows for dns srv queries and statically configured hosts. Combine that with an application specific timeout option and you can have the best of all options
That's nice. Until we have a patch, this functionality is a very very low priority. Alan DeKok.
Thank you all for the replies! This has been very insightful
Sure. Feel free to send a patch which adds this functionality.
Hopefully someone capable does... :) (help me obi-wan! you're my only hope)
just use an LDAP connection pool - define all 3 servers as a load balanced redundant array and then the server will know the state of all three
Gonna look into this for now :) thanks!
On 12 Oct 2017, at 00:56, Dave Macias <davama@gmail.com> wrote:
Thank you all for the replies! This has been very insightful
Sure. Feel free to send a patch which adds this functionality.
Hopefully someone capable does... :) (help me obi-wan! you're my only hope)
Alan knows no one has any hope of producing such a patch. The code in rlm_ldap simply isn't setup to do this kind of dynamic connection/pool creation. There are no issues with resolving DNS entries on startup, many people do it, this issue is with dynamically creating the connections as a result of that resolution. The only module which does anything like what you describe is rlm_redis in v4.0.x which dynamically discovers the cluster nodes from one or more 'bootstrap' nodes. The only way I could see this being implemented is as a side effect of efficient referral following. If we had a facility to keep persistent connections to servers we'd been referred to, we could also co-opt that infrastructure for runtime server resolution. One alternative way of implementing this would be adding an exec style expansion on startup e.g. $SHELL{<program>}. If the number of servers didn't change then that'd work. That at least gets you some dynamic server resolution, but it obviously wouldn't work for referrals, which is where I see this sort of thing being far more useful.
just use an LDAP connection pool - define all 3 servers as a load balanced redundant array and then the server will know the state of all three
Gonna look into this for now :)
Yeah if all you want is redundancy, just do that. Or in v3.0.x you can even specify multiple "server" config items. That'll be gone in v4.0.x though. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Oct 11, 2017, at 11:16 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Alan knows no one has any hope of producing such a patch. The code in rlm_ldap simply isn't setup to do this kind of dynamic connection/pool creation.
Even if it was, I'm not sure it's very useful. DNS is a *terrible* solution for doing round-robin application access. Doing round-robin like that is fine for the wider internet, e.g. geo-location. But for your internal network, you're almost always better off using application-aware round-robin.
Yeah if all you want is redundancy, just do that. Or in v3.0.x you can even specify multiple "server" config items. That'll be gone in v4.0.x though.
You can always configure 4 LDAP modules, and then: redundant-load-balance { ldap1 ldap2 ldap3 ldap4 } And FreeRADIUS will do the right thing. Plus, it will do load-balancing if one of the LDAP servers is down, whereas that doesn't really work well for DNS. Alan DeKok.
just use an LDAP connection pool - define all 3 servers as a load balanced redundant array and then the server will know the state of all three (and use the ones it can talk to). you probably want to use a simple template.conf entry for the boilerplate stuff that is the same for each server. easy alan On 11 October 2017 at 15:18, Dave Macias <davama@gmail.com> wrote:
Is it possible for the module to do DNS discovery of the available ldap servers?
I created a srv record for my ldap servers which im able to resolve. # domain amer.nwk.jwm2.net _ldap._tcp SRV 0 1 389 my-ldap-server1 _ldap._tcp SRV 0 2 389 my-ldap-server2 _ldap._tcp SRV 0 3 389 my-ldap-server3
$ host -t srv _ldap._tcp.amer _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 3 389 my-ldap-server3.amer.nwk.jwm2.net. _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 2 389 my-ldap-server2.amer.nwk.jwm2.net. _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 1 389 my-ldap-server1.amer.nwk.jwm2.net.
$ ldapsearch -LLL -H "ldap:///dc%3Damer.nwk.jwm2.net" -b dc=datacom,dc=net -D "cn=manager,dc=datacom,dc=net" -w '<pass>' uid=config dn: uid=config,ou=People,dc=datacom,dc=net uid: config cn: ECR user givenName: ECR ... ...
Thanks! -dave - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
brendan kearney -
Dave Macias