Hi, I'm trying find out how to correctly configure LDAP server redundacy in Freeradius 3.0.8. I dig trough mailing list archive, found some configuration snippets, but configuration doesn't work for me. We have two LDAP servers in independent locations: ldap.location1.tld.cz ldap.location2.tld.cz there is radius server radius.location1.tld.cz. Now I prepare configuration of radius.location2.tld.cz. My idea is to use ldap.location2 as primary LDAP server at radius.location2 and server ldap.location1 as fallback option in case that ldap.location2 is not available. I added second section to the module ldap configuration: ldap location1 { server = ldap.location1.tld.cz ... ... } ldap location2 { server = ldap.location2.tld.cz ... ... } according to this i altered site inner-tunnel configuration to authorize { location1 if ((ok || updated) && User-Password) { update { control:Auth-Type := mschap } } location2 if ((ok || updated) && User-Password) { update { control:Auth-Type := mschap } } } but this didn't work for me. So i found in another thread piece of configuration with redundant LDAP { location1 location2 } in authentication section there is: Auth-Type LDAP { redundant LDAP { location1 location2 } } but also no luck. All cases leads to authentication fail when one of the ldap server is down. Could someone please explain me the point how correctly setup fail-over between these two LDAP server ? Thanks. Martin
Auth-Type LDAP { redundant LDAP { location1 location2 } }
You just need: redundant { location1 location2 } Can you post debug output (radiusd -X) with the failure. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Jul 7, 2015, at 5:50 PM, Ing. Martin Samek <samekma1@fel.cvut.cz> wrote:
I'm trying find out how to correctly configure LDAP server redundacy in Freeradius 3.0.8. I dig trough mailing list archive, found some configuration snippets, but configuration doesn't work for me.
The first question is: what kind of redundancy do you want? Do you want to use the LDAP servers as databases, and let FreeRADIUS do the authentication? Or do you want to pass the name/password to LDAP, and have the LDAP servers do the authentication? The answer for "how to correctly configure LDAP server redundancy" depends on the answer to those questions.
according to this i altered site inner-tunnel configuration to
You don't need to do that. See this page for how the "redundant" keyword works. http://networkradius.com/doc/3.0.7/unlang/redundant.html See also "man unlang", which has similar text. Alan DeKok.
Alan DeKok wrote:
On Jul 7, 2015, at 5:50 PM, Ing. Martin Samek <samekma1@fel.cvut.cz> wrote:
I'm trying find out how to correctly configure LDAP server redundacy in Freeradius 3.0.8. I dig trough mailing list archive, found some configuration snippets, but configuration doesn't work for me.
The first question is: what kind of redundancy do you want?
Do you want to use the LDAP servers as databases, and let FreeRADIUS do the authentication? Or do you want to pass the name/password to LDAP, and have the LDAP servers do the authentication?
The answer for "how to correctly configure LDAP server redundancy" depends on the answer to those questions.
Frankly I don't understand. Could you please elaborate on why that makes a difference? Is it because sending bind requests to the LDAP server is a new separate connection? Ciao, Michael.
On Jul 8, 2015, at 3:46 AM, Michael Ströder <michael@stroeder.com> wrote:
Alan DeKok wrote:
Do you want to use the LDAP servers as databases, and let FreeRADIUS do the authentication? Or do you want to pass the name/password to LDAP, and have the LDAP servers do the authentication?
The answer for "how to correctly configure LDAP server redundancy" depends on the answer to those questions.
Frankly I don't understand. Could you please elaborate on why that makes a difference?
The question should have been clear.
Is it because sending bind requests to the LDAP server is a new separate connection?
No. To put it simply: LDAP is a database. Use it as a database. FreeRADIUS should pull the "known good" password from the database. FreeRADIUS should do the authentication itself. If you use LDAP "bind as user", you're not using LDAP as a database. And since LDAP doesn't support CHAP, MS-CHAP, or EAP, it won't work for those authentication methods. Alan DeKok.
Alan DeKok wrote:
On Jul 8, 2015, at 3:46 AM, Michael Ströder <michael@stroeder.com> wrote:
Alan DeKok wrote:
Do you want to use the LDAP servers as databases, and let FreeRADIUS do the authentication? Or do you want to pass the name/password to LDAP, and have the LDAP servers do the authentication?
The answer for "how to correctly configure LDAP server redundancy" depends on the answer to those questions.
Frankly I don't understand. Could you please elaborate on why that makes a difference?
The question should have been clear.
Is it because sending bind requests to the LDAP server is a new separate connection?
No.
To put it simply: LDAP is a database. Use it as a database. FreeRADIUS should pull the "known good" password from the database. FreeRADIUS should do the authentication itself.
If you use LDAP "bind as user", you're not using LDAP as a database. And since LDAP doesn't support CHAP, MS-CHAP, or EAP, it won't work for those authentication methods.
Yes, I already know all this. But I still don't get how that makes a difference regarding configuration options for LDAP server redundancy. Ciao, Michael.
On Jul 8, 2015, at 8:39 AM, Michael Ströder <michael@stroeder.com> wrote
Yes, I already know all this. But I still don't get how that makes a difference regarding configuration options for LDAP server redundancy.
It doesn't make a difference for the "redundant" block. But it does make a difference *where* you put the redundant block. authorize { ... redundant { ldap1 ldap2 } } authenticate { ... Auth-Type LDAP { redundant { ldap1 ldap2 } } ... } Alan DeKok.
But where should I but redundant blok when using LDAP as a database and reading password from it? Another problem is that when one ldap server is done - radius server won't start. I have defined two servers location1 and location2 in modules-enabled/ldap ? Martin Dne 8.7.2015 v 15:10 Alan DeKok napsal(a):
On Jul 8, 2015, at 8:39 AM, Michael Ströder <michael@stroeder.com> wrote
Yes, I already know all this. But I still don't get how that makes a difference regarding configuration options for LDAP server redundancy. It doesn't make a difference for the "redundant" block. But it does make a difference *where* you put the redundant block.
authorize { ... redundant { ldap1 ldap2 }
}
authenticate { ... Auth-Type LDAP { redundant { ldap1 ldap2 } } ... }
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ==================================== Ing. Martin Samek ICT systems engineer FELK Admin Czech Technical University in Prague Faculty of Electrical Engineering Department of Control Engineering Karlovo namesti 13/E, 121 35 Prague Czech Republic e-mail: samekma1@fel.cvut.cz phone: +420 22435 7599 mobile: +420 605 285 125 ====================================
--On 9. Juli 2015 10:21:45 +0200 "Ing. Martin Samek" <samekma1@fel.cvut.cz> wrote:
Another problem is that when one ldap server is done - radius server won't start. I have defined two servers location1 and location2 in modules-enabled/ldap ?
You have to set start = 0 in your pool. I learned that the hard way myself ;-) -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.
Thanks, I have to define some ldap pool or "start" option belong directly to ldap definition ? Martin Dne 9.7.2015 v 11:05 Sebastian Hagedorn napsal(a):
--On 9. Juli 2015 10:21:45 +0200 "Ing. Martin Samek" <samekma1@fel.cvut.cz> wrote:
Another problem is that when one ldap server is done - radius server won't start. I have defined two servers location1 and location2 in modules-enabled/ldap ?
You have to set
start = 0
in your pool. I learned that the hard way myself ;-)
-- ==================================== Ing. Martin Samek ICT systems engineer FELK Admin Czech Technical University in Prague Faculty of Electrical Engineering Department of Control Engineering Karlovo namesti 13/E, 121 35 Prague Czech Republic e-mail: samekma1@fel.cvut.cz phone: +420 22435 7599 mobile: +420 605 285 125 ====================================
On Jul 9, 2015, at 4:21 AM, Ing. Martin Samek <samekma1@fel.cvut.cz> wrote:
But where should I but redundant blok when using LDAP as a database and reading password from it?
In the "authorize" section, where the "ldap" module is already listed.
Another problem is that when one ldap server is done - radius server won't start. I have defined two servers location1 and location2 in modules-enabled/ldap ?
Set "start = 0" in the LDAP module "pool" configuration. This is documented in the default ldap module. Alan DeKok.
Dne 9.7.2015 v 13:51 Alan DeKok napsal(a):
On Jul 9, 2015, at 4:21 AM, Ing. Martin Samek <samekma1@fel.cvut.cz> wrote:
But where should I but redundant blok when using LDAP as a database and reading password from it? In the "authorize" section, where the "ldap" module is already listed.
Another problem is that when one ldap server is done - radius server won't start. I have defined two servers location1 and location2 in modules-enabled/ldap ? Set "start = 0" in the LDAP module "pool" configuration. This is documented in the default ldap module.
Alan DeKok. Done, LDAP server failover work for me now. Thanks. Martin
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
The first question is: what kind of redundancy do you want?
Do you want to use the LDAP servers as databases, and let FreeRADIUS do the authentication? Or do you want to pass the name/password to LDAP, and have the LDAP servers do the authentication?
The answer for "how to correctly configure LDAP server redundancy" depends on the answer to those questions. We are using LDAP as a password database and FreeRADIUS is doing authentication. Ldap is defined like follows:
ldap feld { server = 'ldaps://ldap.location2.tld.cz:636' identity = 'uid=blah,ou=Special Users,o=blah.cz' password = blah base_dn = 'ou=People,o=blah.cz' update { control:Cleartext-Password := 'mobilitypassword' reply:Tunnel-Private-Group-ID += 'departmentNumber' }
according to this i altered site inner-tunnel configuration to You don't need to do that. See this page for how the "redundant" keyword works.
http://networkradius.com/doc/3.0.7/unlang/redundant.html
See also "man unlang", which has similar text.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks. Martin
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
Ing. Martin Samek -
Michael Ströder -
Sebastian Hagedorn