I am sure this question has been asked many times over, so please point me to a thread if it's already answered. We are connected to an AD-backed LDAP service. I've configured these two options in the ldap module config: Chase_referrals=yes Rebind=yes LDAP authentication is fine for about 10 minutes. After a while, freeradius LDAP authentication begins failing: rad_recv: Access-Request packet from host 10.144.15.2 port 52361, id=92, length=98 User-Name = "redacted-user" User-Password = "redacted-password" NAS-Port-Id = "ssh" Calling-Station-Id = "redacted-fqdn" Service-Type = NAS-Prompt-User NAS-Port = 0 NAS-IP-Address = 10.144.15.2 # Executing section authorize from file /etc/freeradius/radiusd.conf +group authorize { ++[preprocess] = ok [ldap] performing user authorization for redacted-user [ldap] expand: (SamAccountName=%u) -> (SamAccountName=redacted-user) [ldap] expand: dc=redacted,dc=redacted,dc=com -> dc=redacted,dc=redacted,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] closing existing LDAP connection [ldap] (re)connect to ldaps://redacted-ldaps-server-url, authentication 0 [ldap] setting TLS Require Cert to never [ldap] bind as _binduser/bindpassword to ldaps://redacted-ldaps-server-url [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=redacted,dc=Redacted,dc=com, with filter (SamAccountName=redacted-user) WARNING: Please set 'chase_referrals=yes' and 'rebind=yes' WARNING: See the ldap module configuration for details [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = fail +} # group authorize = fail Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 92 to 10.144.15.2 port 52361 Waking up in 4.9 seconds. Cleaning up request 4 ID 92 with timestamp +2501 Ready to process requests. It works fine for a while - what causes it to fail after a while? Does having a loadbalancer in front of the LDAP server make a difference? Thanks! [https://cdn.f5.com/webcommon/email-signature/images/f5-logo-rgb-30x30.jpg]<https://f5.com/> Thomas King | Sr Lab Network Engineer D +1-303-305-0228 M +1-206-384-0698 [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-twitter.jpg]<https://twitter.com/F5Networks/> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-linkedin.jpg]<https://www.linkedin.com/companies/f5-networks> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-facebook.jpg]<https://www.facebook.com/f5networksinc> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-youtube.jpg]<https://www.youtube.com/f5networksinc> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-devcentral.jpg]<https://devcentral.f5.com/> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-wmag-lockup.jpg]<https://f5.com/we-make-apps-go?utm_source=WMAGSIG/>
On Jan 9, 2018, at 8:11 PM, Tom King via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I am sure this question has been asked many times over, so please point me to a thread if it's already answered.
We are connected to an AD-backed LDAP service.
AD is unfortunately a *terrible* LDAP server.
I've configured these two options in the ldap module config: Chase_referrals=yes Rebind=yes
That's good...
LDAP authentication is fine for about 10 minutes. After a while, freeradius LDAP authentication begins failing: ... [ldap] performing search in dc=redacted,dc=Redacted,dc=com, with filter (SamAccountName=redacted-user) WARNING: Please set 'chase_referrals=yes' and 'rebind=yes' WARNING: See the ldap module configuration for details
I've fixed the code in 3.0.16 so that it doesn't print this complaint if you've already set those flags.
[ldap] ldap_search() failed: Operations error
That's an LDAP server error. Your LDAP server doesn't like you. It's *usually* because the account does not have permission to read the data it's querying/
It works fine for a while - what causes it to fail after a while?
Active Directory magic? FreeRADIUS does LDAP queries. If the back-end randomly decides to fail, there isn't much you can do to FreeRADIUS to fix the problem. The choices are: 1) use a query which always succeeds, no matter what back-end you're using 2) use a back-end that doesn't suck :(
Does having a loadbalancer in front of the LDAP server make a difference?
Maybe. If the back-end databases are *not* all identical, then load-balancing to one will give you "operations error", while load-balancing to another one will work. Alan DeKok.
Still running an older Freeradius version, I needed to add those two options to radiusd.conf. I'm also now pointing directly to an AD server - I found out today that other services depending on LDAP had to point away from the load balancer to get stability. I'll update once I let this run a while and prove either way. Tom King
This worked. I'm not sure of the magic bullet, but correcting my radiusd.conf and pointing directly to an AD server instead of the loadbalancer stabilized our RADIUS service. Thanks! Tom King -----Original Message----- From: Tom King Sent: Wednesday, January 10, 2018 12:34 PM To: 'Alan DeKok' <aland@deployingradius.com>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: RE: LDAP operations error Still running an older Freeradius version, I needed to add those two options to radiusd.conf. I'm also now pointing directly to an AD server - I found out today that other services depending on LDAP had to point away from the load balancer to get stability. I'll update once I let this run a while and prove either way. Tom King
participants (2)
-
Alan DeKok -
Tom King