Hello, I tried setup redundant ldap on latest git version of FR3. ldaps are defined in module ldap: ldap ldap1 { ... } ldap ldap3 { ... } sites default and inner-tunnel are changed from ldap to redundant { ldap1 ldap3 } If connections to ldap is established, fr returns "Login OK" and eapol_test SUCCESS. If someone ldap connection is down, fr returns "Login OK", but eapol_test trying resending requests (in freeradius log I see "Discarding duplicate request from client test port 36732 - ID: 11 due to unfinished request") In debug "freeradius -fxx -l stdout" returns Login incorect, and eapol_test failed immediatly: (9) redundant redundant { (9) ERROR: ldap1 : All ldap connections are in use (9) [ldap1] = fail (9) ERROR: ldap3 : All ldap connections are in use (9) [ldap3] = fail (9) } # redundant redundant = fail (9) } # authorize = fail LDAP server is eDirectory. Thank you for tips Pavel Polacek
Polish wrote:
If someone ldap connection is down, fr returns "Login OK", but eapol_test trying resending requests (in freeradius log I see "Discarding duplicate request from client test port 36732 - ID: 11 due to unfinished request")
In debug "freeradius -fxx -l stdout" returns Login incorect, and eapol_test failed immediatly:
Please post the *entire* debug log. There may be some *other* message which is useful. Alan DeKok.
Hello, entire log is in attachment (gzipped because of size). Thank you Pavel Polacek On Wed, 11 Dec 2013, Alan DeKok wrote:
Polish wrote:
If someone ldap connection is down, fr returns "Login OK", but eapol_test trying resending requests (in freeradius log I see "Discarding duplicate request from client test port 36732 - ID: 11 due to unfinished request")
In debug "freeradius -fxx -l stdout" returns Login incorect, and eapol_test failed immediatly:
Please post the *entire* debug log. There may be some *other* message which is useful.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Polish wrote:
entire log is in attachment (gzipped because of size).
As I suspected, you're doing EAP. You CANNOT use Active Directory as an LDAP server for EAP. It's impossible. You MUST use Samba too. Please follow the guide below. NOTHING else will work. http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.
Hello, sorry Alan, but we talk about eDirectory, where non redundant ldap configuration works well, but redundant variant behaves weird as described in first mail of thread. Maybe I setup it incorrectly. I need only fail-over over ldaps connections. Pavel Polacek On Fri, 13 Dec 2013, Alan DeKok wrote:
Polish wrote:
entire log is in attachment (gzipped because of size).
As I suspected, you're doing EAP. You CANNOT use Active Directory as an LDAP server for EAP. It's impossible. You MUST use Samba too.
Please follow the guide below. NOTHING else will work.
http://deployingradius.com/documents/configuration/active_directory.html
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 13.12.2013 17:57, Polish wrote:
Hello,
entire log is in attachment (gzipped because of size).
# Skipping instantiation of ldap1 Actually that's weird. And it should open connections to the ldap servers on startup. What's also weird is that you don't have a pool {} section in your configuration ... Did you just move a 2.X configuration to 3.0, or did you build it from a vanilla 3.0 configuration ? (you can't just move 2.x conf to 3.x. things changed, other moved, some disapeared, and many new items were added) Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org
Hello Olivier, On Fri, 13 Dec 2013, Olivier Beytrison wrote:
On 13.12.2013 17:57, Polish wrote:
Hello,
entire log is in attachment (gzipped because of size).
# Skipping instantiation of ldap1
Actually that's weird. And it should open connections to the ldap servers on startup.
What's also weird is that you don't have a pool {} section in your configuration ...
Did you just move a 2.X configuration to 3.0, or did you build it from a vanilla 3.0 configuration ? (you can't just move 2.x conf to 3.x. things changed, other moved, some disapeared, and many new items were added)
I understand. It's vanilla configuration, but I try to add similar functions which I have on 2.2 branch (FR2.2 is template for me). I looking for module ldap documentation in version 3.0. Now I looking for replacement of password_attribute option for example. I try to test FR3 against 389 ldap server. This option in FR3 example configuration is missing. Thank you Pavel Polacek
Olivier
On 14 Dec 2013, at 10:33, Polish <pavel.polacek@ujep.cz> wrote:
Hello Olivier,
On Fri, 13 Dec 2013, Olivier Beytrison wrote:
On 13.12.2013 17:57, Polish wrote:
Hello,
entire log is in attachment (gzipped because of size).
# Skipping instantiation of ldap1
Actually that's weird. And it should open connections to the ldap servers on startup.
What's also weird is that you don't have a pool {} section in your configuration ...
Did you just move a 2.X configuration to 3.0, or did you build it from a vanilla 3.0 configuration ? (you can't just move 2.x conf to 3.x. things changed, other moved, some disapeared, and many new items were added)
I understand. It's vanilla configuration, but I try to add similar functions which I have on 2.2 branch (FR2.2 is template for me).
Well that won't work, 3.0 changed substantially. Only the logic is really portable (unlang is pretty much unchanged).
I looking for module ldap documentation in version 3.0.
Now I looking for replacement of password_attribute option for example. I try to test FR3 against 389 ldap server. This option in FR3 example configuration is missing.
That functionality was removed, because it was duplicative on the PAP module. The PAP module will examine the header on control:Password-With-Header attributes, normalise them and then copy them to the hash specific attribute. e.g. control:NT-Password. In order to get similar functionality to 2.x.x you just need to list Password-With-Header in the update section. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avail... -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hello Arran,
That functionality was removed, because it was duplicative on the PAP module.
The PAP module will examine the header on control:Password-With-Header attributes, normalise them and then copy them to the hash specific attribute. e.g. control:NT-Password.
In order to get similar functionality to 2.x.x you just need to list Password-With-Header in the update section.
https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avail...
-Arran
that helps me solve issue with radius password attribute. Thank you
Polish wrote I tried setup redundant ldap on latest git version of FR3.
Depending on your exact needs for redundancy/lb, you might also want to consider just using one FR ldap instance and putting an RR dns entry in for your servers. OpenLDAP will balance across the DNS entries.
On 12 Dec 2013, at 14:56, Brian Julin <BJulin@clarku.edu> wrote:
Polish wrote I tried setup redundant ldap on latest git version of FR3.
Depending on your exact needs for redundancy/lb, you might also want to consider just using one FR ldap instance and putting an RR dns entry in for your servers. OpenLDAP will balance across the DNS entries.
You can also just list multiple space delimited LDAP servers in the rlm_ldap config. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Arran Cudbard-Bell wrote:
On 12 Dec 2013, at 14:56, Brian Julin <BJulin@clarku.edu> wrote:
Polish wrote I tried setup redundant ldap on latest git version of FR3.
Depending on your exact needs for redundancy/lb, you might also want to consider just using one FR ldap instance and putting an RR dns entry in for your servers. OpenLDAP will balance across the DNS entries.
You can also just list multiple space delimited LDAP servers in the rlm_ldap config.
We actually do both: RRDNS then list the RRDNS name several times.
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
Brian Julin -
Olivier Beytrison -
Polish