RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
-----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, July 13, 2005 2:20 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
Zawacki Jason D Ctr AFRL/IFOS <Jason.Zawacki.ctr@rl.af.mil> wrote:
I've been trying to get this to work, but it appears, to me, that the redundancy is only used for part of the auth process.
What "auth" process? Authorize or authenticate?
When looking up the DN for the user who is trying to authenticate, redundancy works.
During the "authorize" stage.
After that though, it appears that only the first module in the redundant list is tried.
Which redundant list? You listed two.
authenticate { Auth-Type LDAP { redundant { # wasn't sure if this was necessary svr1
If you want redundancy for authentication, you can list that.
I test by simulating a failure of svr1 using:
Ok. The debug log shows:
modcall[authorize]: module "svr1" returns fail for request 0 ... modcall[authorize]: module "svr3" returns fail for request 0 ... modcall[authorize]: module "svr2" returns ok for request 0
So the redundancy in the "authorize" section works.
rlm_ldap::ldap_groupcmp: Search returned error
You're using the LDAP-Group attribute, which is set to use svr1, which is down. There's currently no fail-over for the LDAP-Group attribute.
I dig, that's kind of what I thought (even if I didn't word it correctly). Thanks for your help! Jason
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
You're using the LDAP-Group attribute, which is set to use svr1, which is down. There's currently no fail-over for the LDAP-Group attribute.
I dig, that's kind of what I thought (even if I didn't word it correctly). Thanks for your help!
You can simulate redundancy for the Ldap-Group attribute, by doing this. Instantiate your ldap modules in radiusd.conf. instantiate { srv1 srv2 srv3 } In users file, add multiple lines of the same ldap-group lookup, for each srv. For example, say you must have ldap-group of dial if coming from a dial huntgroup. DEFAULT Huntgroup-Name == dial, srv1-Ldap-Group == dial DEFAULT Huntgroup-Name == dial, srv2-Ldap-Group == dial DEFAULT Huntgroup-Name == dial, srv3-Ldap-Group == dial What will happen is if the huntgroup matches, then the server will lookup on the srv1 instance if ldap-group = dial. If so, it matches and the users file ends. If not, it continues down the file, where it will then try srv2. If that fails, it continues to srv3. So, if one and two are down, then this will require 3 different lookups to finally get to srv3, but it will provide you with some type of redundancy.
participants (2)
-
Dusty Doris -
Zawacki Jason D Ctr AFRL/IFOS