On 06.10.22 15:57, Elias Pereira wrote:

hi,

Thanks for the reply!!!

I have a post-auth to direct the user to a specific vlan.

It would look like this?

redundant-load-balance { ldap-dc3 ldap-dc4 }

# Auth-Type LDAP { # ldap # }

eap

# Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } }

post-auth { redundant-load-balance { ldap-dc3 ldap-dc4 } if (Ldap-Group == "CN=ADM,OU=GRUPOS,OU=CAMPUS,DC=company,DC=net") { update reply { &Tunnel-Type = VLAN &Tunnel-Medium-Type = IEEE-802 &Tunnel-Private-Group-Id = "51" } }

...

On Thu, Oct 6, 2022 at 10:48 AM Michael Schwartzkopff via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:

...

On 06.10.22 15:43, Elias Pereira wrote:

...

hi,

I was reading the load-balance article on the freeradius wiki and had some doubts.

I have two vms with sambaAD. In mod-enable > ldap I need to configure 2 entries of the ldap block?

eg: ldap1{ ... }

ldap2{ ... }

2. Is the loadbalance setting done in the file sites-enable > default?

hi,

with the config above you configured the modules ldap1 and ldap2. You have to tell your server, i.e. the default server, to use this modules during authorization.

Add something like instead of the default "ldap" statement.

redundant-load-balance { ldap1 ldap2 }

Mit freundlichen Grüßen,

--

[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi, I don't know about your setup and config. But it looks reasonable. If it works, it works. Just test it and read the debug output. check if the logs make sense and give a reasonable result. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

Ok. I corrected the error by modifying the entries in mod_enable > ldap to. ldap dc3 { ... } ldap dc4 { ... } The error is now at: /etc/freeradius/sites-enabled/default[199]: Redundancy analysis errors - load balancing subsection It looks like this: redundant-load-balance { dc3 dc4 } } post-auth { redundant-load-balance { dc3 dc4 } How should I configure it? On Thu, Oct 6, 2022 at 12:19 PM Elias Pereira <empbilly@gmail.com> wrote:

hello,

return the below error:

/etc/freeradius/mods-enabled/ldap[3]: Failed to link to module 'rlm_ldap-dc3': /usr/lib/freeradius/rlm_ldap-dc3.so: cannot open shared object file: No such file or directory

On Thu, Oct 6, 2022 at 12:18 PM Michael Schwartzkopff <ms@sys4.de> wrote:

...

On 06.10.22 15:57, Elias Pereira wrote:

...

hi,

Thanks for the reply!!!

I have a post-auth to direct the user to a specific vlan.

It would look like this?

redundant-load-balance { ldap-dc3 ldap-dc4 }

# Auth-Type LDAP { # ldap # }

eap

# Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } }

post-auth { redundant-load-balance { ldap-dc3 ldap-dc4 } if (Ldap-Group == "CN=ADM,OU=GRUPOS,OU=CAMPUS,DC=company,DC=net") { update reply { &Tunnel-Type = VLAN &Tunnel-Medium-Type = IEEE-802 &Tunnel-Private-Group-Id = "51" } }

...

On Thu, Oct 6, 2022 at 10:48 AM Michael Schwartzkopff via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:

...

On 06.10.22 15:43, Elias Pereira wrote:

...

hi,

I was reading the load-balance article on the freeradius wiki and had some doubts.

I have two vms with sambaAD. In mod-enable > ldap I need to configure 2 entries of the ldap block?

eg: ldap1{ ... }

ldap2{ ... }

2. Is the loadbalance setting done in the file sites-enable > default?

hi,

with the config above you configured the modules ldap1 and ldap2. You have to tell your server, i.e. the default server, to use this modules during authorization.

Add something like instead of the default "ldap" statement.

redundant-load-balance { ldap1 ldap2 }

Mit freundlichen Grüßen,

--

[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi,

I don't know about your setup and config. But it looks reasonable.

If it works, it works. Just test it and read the debug output. check if the logs make sense and give a reasonable result.

Mit freundlichen Grüßen,

--

[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

-- Elias Pereira

-- Elias Pereira

hi Alan, thanks for the reply!!! There is no message in the server which says "Redundancy analysis errors". Where did you get your copy of FreeRADIUS from? https://hub.docker.com/r/freeradius/freeradius-server I have a docker container running correctly without load-balance. Since I have 2 sambaADs, I wanted to do the load-balance. That should be fine. Follow the documentation. All of this is *very* well documented. Ok. I actually followed the documentation and so I set it up as shown above. But this problem occurs. I'll look into it further. On Thu, Oct 6, 2022 at 2:11 PM Alan DeKok <aland@deployingradius.com> wrote:

On Oct 6, 2022, at 12:20 PM, Elias Pereira <empbilly@gmail.com> wrote:

...

I corrected the error by modifying the entries in mod_enable > ldap to.

Which is what the documentation says to do.

...

The error is now at: /etc/freeradius/sites-enabled/default[199]: Redundancy analysis errors -

There is no message in the server which says "Redundancy analysis errors".

Where did you get your copy of FreeRADIUS from?

...

load balancing subsection

It looks like this:

redundant-load-balance { dc3 dc4 }

That should be fine.

...

How should I configure it?

Follow the documentation. All of this is *very* well documented.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Elias Pereira

Thanks Alan!!! This way below is also done the load-balance between the ldap servers? ldap { server = 'ldap1.net' server = 'ldap2.net' port = 389 ... On Thu, Oct 6, 2022 at 2:36 PM Alan DeKok <aland@deployingradius.com> wrote:

On Oct 6, 2022, at 1:17 PM, Elias Pereira <empbilly@gmail.com> wrote:

...

Where did you get your copy of FreeRADIUS from?

https://hub.docker.com/r/freeradius/freeradius-server

Well, it doesn't contain a message "redundancy analysis errors".

So either you have a modified version of FreeRADIUS, or you're not cutting & pasting the error message correctly.

...

Ok. I actually followed the documentation and so I set it up as shown above.

The documentation doesn't lie. If you follow it, it works.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Elias Pereira

Arran Cudbard-Bell says it works. "I wrote the rlm_ldap module distributed with FreeRADIUS version 3. OpenLDAP's libldap will accept multiple servers and will failover between them just fine. This mechanism is more efficient as it doesn't require repeatedly calling instances of rlm_ldap just to have them fail. redundant {} and redundant-load-balance {} have no state beyond the current request, and no way to determine the current state of the upstream connection" Link: https://stackoverflow.com/a/19103323/8442925 On Fri, Oct 7, 2022 at 10:18 AM Alan DeKok <aland@deployingradius.com> wrote:

On Oct 7, 2022, at 7:57 AM, Elias Pereira <empbilly@gmail.com> wrote:

...

This way below is also done the load-balance between the ldap servers?

ldap { server = 'ldap1.net' server = 'ldap2.net' port = 389

Does the ldap module documentation say that this will work?

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Elias Pereira

Calm dowm, Allan!!! Why the stress!? What's your goal here? Why the question? My argument was based on the configuration that I asked if it was correct! I put this setting in the ldap module and it worked. But first I wanted to get your opinion if it was really correct. It was you who missed my point. If you're going to ignore the documentation and argue endlessly, then I

suggest forking FreeRADIUS. You can then fix it to do whatever you want, and you don't need us.

if you're not going to fork FreeRADIUS, then it works as documented.

Read the documentation. Stop arguing. Stop reading (and misunderstanding) random things you find on the net.

If I am here on the list it is because I have doubts. Doubts that I have already read the documentation and so far, could not solve. Why do you act this way? I am not the first and I will not be the last one that you act this way! It is not necessary! Does that mean that no one on this list is free to question anything? Doesn't "democracy" reign here? On Fri, Oct 7, 2022 at 11:05 AM Alan DeKok <aland@deployingradius.com> wrote:

On Oct 7, 2022, at 9:58 AM, Elias Pereira <empbilly@gmail.com> wrote:

...

Arran Cudbard-Bell says it works.

No, that's not what he says. He says libldap has certain functionality. He doesn't say that FreeRADIUS supports this.

What's your goal here?

If you're going to ignore the documentation and argue endlessly, then I suggest forking FreeRADIUS. You can then fix it to do whatever you want, and you don't need us.

if you're not going to fork FreeRADIUS, then it works as documented. Read the documentation. Stop arguing. Stop reading (and misunderstanding) random things you find on the net.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Elias Pereira

At what point did I say that you are a bad person? I only gave my opinion on how you talk to people. That's all. But anyway, I apologize if you felt bad about what I said. By reading the documentation, I was able to set up our freeradius server. I went back to the documentation again to try to set up the load-balance. *"Let the first stone throw who never went to the documentation, read it, couldn't understand it, and went looking for help somewhere else!!!"* And as for banning me from the list, feel free, because it is yours and you have the right to do that. But let it be very clear that I am not playing the victim at any time. In case we can return to the crux of my question, I ask. Is the version of the docker image I am using official? If not, I will manually install it from the official package. Thanks, On Fri, Oct 7, 2022 at 11:35 AM Alan DeKok <aland@deployingradius.com> wrote:

On Oct 7, 2022, at 10:14 AM, Elias Pereira <empbilly@gmail.com> wrote: ... a large number of complaints about being the victim ...

It's really simple. Read the documentation. Follow instructions. It's not hard.

Doing that will help you fix your problems. Not doing that is unproductive, and anti-social.

When you don't read the documentation, it's rude. When you don't follow instructions, it's rude.

When the LDAP module has *explicit* documentation about a subject, and you post to the list asking "is that really true"? It's rude. It's implying that the documentation is lying to you.

We're not here to reassure you over and over again. We're here to give technical advice to technical questions.

When you make it clear that you're not going to follow the advice you get here, I have to ask: why are you here?

Because if your goal is to complain about how we're mean, you will be unsubscribed from the list and permanently banned. This is your only warning.

Alan DeKek.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Elias Pereira

On Oct 7, 2022, at 2:43 PM, Brantley Padgett via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

Wait, just to make sure I understand, if I have a similar setup to the answer in that SO question, it doesn't failover, or are you saying it doesn't do any load balancing?

I'm saying that the server works as documented. The original poster made it *very* clear that he had little intention of reading the docs, or doing anything reasonable to solve his problem. He asked the list about the functionality of the LDAP module. When the module contains FULL documentation on what it does, and how it works. When I suggested he read that documentation, he didn't. Instead he found some random post from years ago, and went off on a tangent about that. This is evidence that he's posting just to stir up trouble. Or, he's asking questions with no intention of paying attention to the answers. Either way, it's unacceptable. Read his last message to see what his attitude is. It in *no way* has anything to do with what I said. So once again, he proves he cannot read the most basic of content and understand it. At that point, it's impossible to help someone.

I'm running FreeRADIUS Version 3.0.20 from the Ubuntu standard repo: freeradius/focal-updates,now 3.0.20+dfsg-3ubuntu0.1 amd64 [installed]

I'd recommend 3.0.26 at least. We have packages on http://packages.networkradius.com They have many features and bug fixes over 3.0.20.

So looking closer, I didn't realize/understand there was anything like redundant-load-balance. I see that now.

Where does the redundant-load-balance statement go?

In the processing section. authorize / authenticate / etc.

I.E. I have my list of servers under raidusd.conf > modules > ldap ... Putting in the main conf was for ease of writing puppet/ansible modules to install and maintain radius vs multiple files. So would the redundant-load-balance section go under that?

No. Again... the documentation makes it clear where the "load-balance" keyword goes. I really don't know how else to say this. Where should we be putt the load-balance documentation so that people will read it?

Currently looks like: # MODULE CONFIGURATION modules { $INCLUDE mods-enabled/ ldap { server = 'ldap01.example.net' server = 'ldap02.example.net' server = 'ldap03.example.net'

That's fine. The libldap code will handle failover. As is documented in the mods-available/ldap file.

Should become:

No. Alan DeKok.