auto scaling freeradius instance on openshift and state-ID problem
I was able to run freeradius instance on kubernetes / openshift. and I am using 2FA via freeradius. my problem is; when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD. The other radius pod is rejecting the reply coming from the client because of the state created by the other radius POD. is there a solution or workaround for this case? best regards.
On Oct 28, 2023, at 9:21 AM, Mesut GULNAZ <mesutgl@gmail.com> wrote:
I was able to run freeradius instance on kubernetes / openshift. and I am using 2FA via freeradius.
my problem is;
when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD.
I don't know what that means. What's a "state-ID"?
The other radius pod is rejecting the reply coming from the client because of the state created by the other radius POD.
is there a solution or workaround for this case?
Post the debug output. http://wiki.freeradius.org/list-help Alan DeKok.
I tried to explain. How do I prevent RADIUS PODs from returning "Access-Reject" to the end user due to state-IDs that are not created by them but created by other PODs? On Sat, Oct 28, 2023 at 7:09 PM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 28, 2023, at 9:21 AM, Mesut GULNAZ <mesutgl@gmail.com> wrote:
I was able to run freeradius instance on kubernetes / openshift. and I am using 2FA via freeradius.
my problem is;
when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD.
I don't know what that means. What's a "state-ID"?
The other radius pod is rejecting the reply coming from the client because of the state created by the other radius POD.
is there a solution or workaround for this case?
Post the debug output.
http://wiki.freeradius.org/list-help
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- İyi çalışmalar... Mesut GÜLNAZ
On 29/10/2023 14:52, Mesut GULNAZ wrote:
How do I prevent RADIUS PODs from returning "Access-Reject" to the end user due to state-IDs that are not created by them but created by other PODs?
What's a "RADIUS POD" supposed to be? Trying to guess what you're trying to do, you need to fix your load balancer to send requests to the correct backend. -- Matthew
Hi Matthew, thanks for rapid response, RADIUS POD is a POD running freeradius images in a openshift environment. in openshift there is no load balancer in terms of a real one, but just a simple LB always working in the round robin mode. On Sun, Oct 29, 2023 at 6:00 PM Matthew Newton via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
On 29/10/2023 14:52, Mesut GULNAZ wrote:
How do I prevent RADIUS PODs from returning "Access-Reject" to the end user due to state-IDs that are not created by them but created by other PODs?
What's a "RADIUS POD" supposed to be?
Trying to guess what you're trying to do, you need to fix your load balancer to send requests to the correct backend.
-- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- İyi çalışmalar... Mesut GÜLNAZ
On 29/10/2023 15:08, Mesut GULNAZ wrote:
RADIUS POD is a POD running freeradius images in a openshift environment.
This might explain why it helps to use the correct terminology: https://wiki.freeradius.org/protocol/Disconnect-Messages -- Matthew
On Oct 29, 2023, at 10:52 AM, Mesut GULNAZ <mesutgl@gmail.com> wrote:
I tried to explain. How do I prevent RADIUS PODs from returning "Access-Reject" to the end user due to state-IDs that are not created by them but created by other PODs?
Again, what is a "state-ID"? You are not using standard RADIUS words, so I don't know what you mean. Perhaps you could try posting the debug output as suggested by ALL of the documentation. You should also CLEARLY describe what you're doing. Your messages assume that we know everything you know. Which isn't true, and so we have no idea what you mean by "state-ID" or "PODs". Explain what you're doing in detail. Use standard RADIUS words. Show the debug output. And read the Wiki page I posted in my last message. It explains all of this. It is not polite to ask questions, and then ignore the answers. It's not polite to not read the documentation. It's not polite to post the same content-free message when you're asked to explain in more detail. If you don't explain what you're doing, we're simply going to ignore your questions. We can only help people when they actually listen to the answers we give here. Alan DeKok.
Thank U Alan, I will collect all and send in my next email. On Sun, Oct 29, 2023 at 6:06 PM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 29, 2023, at 10:52 AM, Mesut GULNAZ <mesutgl@gmail.com> wrote:
I tried to explain. How do I prevent RADIUS PODs from returning "Access-Reject" to the end
user
due to state-IDs that are not created by them but created by other PODs?
Again, what is a "state-ID"?
You are not using standard RADIUS words, so I don't know what you mean.
Perhaps you could try posting the debug output as suggested by ALL of the documentation.
You should also CLEARLY describe what you're doing. Your messages assume that we know everything you know. Which isn't true, and so we have no idea what you mean by "state-ID" or "PODs".
Explain what you're doing in detail. Use standard RADIUS words. Show the debug output.
And read the Wiki page I posted in my last message. It explains all of this.
It is not polite to ask questions, and then ignore the answers. It's not polite to not read the documentation. It's not polite to post the same content-free message when you're asked to explain in more detail.
If you don't explain what you're doing, we're simply going to ignore your questions. We can only help people when they actually listen to the answers we give here.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- İyi çalışmalar... Mesut GÜLNAZ
On Sat, 28 Oct 2023 at 15:22, Mesut GULNAZ <mesutgl@gmail.com> wrote:
when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD.
I guess you are trying to use some "standard" UDP load balancer (or controller IIRC how it is named) on k8s cluster from OpenShift. I know nothing about it but I think it assumes that any server behind load balancer is always equal and does not store any state, therefore it assumes that any request will be served correctly. In simple cases when the radius server can get all the necessary information to make a decision about authentication from 1 incoming radius packer this will work. But in cases when authentication requires many roundtrips between the radius client and radius server, for example during EAP authentication and checking SSL cert, the load balancer has to send all packets in "session" to the same radius server. Other servers behind LB simply will not have enough information to continue establishing EAP "tunnel" and will abort authentication. If you have many radius clients that send packets to k8s load balancer, you can try to configure the load balancer to use a combination of IP + src port as a hash key that will be used to route all incoming packets to the same server behind LB. If you have only 1 client and want to use LB to be able to spread load between many servers behind LB, you probably need to find LB that can read/parse radius protocol and for example use Calling-Station-ID attribute as a hash key to route traffic to the same radius server behind LB.
participants (4)
-
Alan DeKok -
Matthew Newton -
Mesut GULNAZ -
work vlpl