load balancing and if statements
FR 2.1.10 on Linux I want to load balance my LDAP servers, but I also want to do some checking for group membership. Reading the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 makes me think I can use if and elsif statements in a load balancing block, as long as the rules in the table are followed. However, when I try to do this, I get the following errors in my log:
/etc/freeradius/sites-enabled/default[173]: load-balance sections cannot contain a "if" statement
Here is the configuration I am attempting:
load-balance { ldap1
if (Ldap-Group == "NET Staff") { if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == "10.52.6.4") { update reply { Passport-Access-Priority = 6 } } } # Reject everyone else to the routers elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == "10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == "10.51.0.2") { reject }
ldap2
if (Ldap-Group == "NET Staff") { if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == "10.52.6.4") { update reply { Passport-Access-Priority = 6 } } } # Reject everyone else to the routers elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == "10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == "10.51.0.2") { reject } }
If I can't use if statements in a load balance block, can anyone suggest another way to go about accomplishing what I want to do here? Thank you, Scott
Scott McLane Gardner Wrote:
Here is the configuration I am attempting:
load-balance { ldap1
if (Ldap-Group == "NET Staff") {
I cannot answer your question about if statements, but this much is clear: the Ldap-Group check attribute will query the ldap module that was instantiated last. If you want to query a specific module, you have to use <modulename>-Ldap-Group. Similarly for ldap xlats, you have to use the module name. (A sensible wishlist item might be to have load-balance sections in the instantiate section register the same hooks as their submodules, then you'd be able to name the load-balance and use <lbr-modulename>-Ldap-Group. But that sounds mildly hairy to implement.)
I cannot answer your question about if statements, but this much is clear: the Ldap-Group check attribute will query the ldap module that was instantiated last. If you want to query a specific module, you have to use <modulename>-Ldap-Group.
Similarly for ldap xlats, you have to use the module name.
(A sensible wishlist item might be to have load-balance sections in the instantiate section register the same hooks as their submodules, then you'd be able to name the load-balance and use <lbr-modulename>-Ldap-Group. But that sounds mildly hairy to implement.)
Does this mean that what I want to do is not possible? -Scott
Scott McLane Gardner
(A sensible wishlist item might be to have load-balance sections in the instantiate section register the same hooks as their submodules, then you'd be able to name the load-balance and use <lbr-modulename>-Ldap-Group. But that sounds mildly hairy to implement.)
Does this mean that what I want to do is not possible?
I don't know, but I'll probably look into it over the next week or two, because I never looked too hard at the LDAP config I inherited, and didn't realize it was not load-balancing those requests myself, and in fact isn't even redundant, so I'll be looking to fix that (thanks for pointing it out BTW.) I would think you might be able to get at least fail-over redundancy working using the XLAT "%{%{thing1}:-%{thing2}}" syntax, but I'm unsure right now as to how the interaction between the Ldap-Group "check attribute" and the XLAT mechanism works.
Hi,
Does this mean that what I want to do is not possible?
my advice was so you werent doing all that LDAP-Group , NAS-IP-Address stuff in unlang... regarding the load-balance, you should be okay just keeping that bit similar to how you had it ...heck, you might even try redundant-load-balance { ldap1 ldap2 } man unlang alan
hi, a quick glance at your question and i'd say you be better off using simple entries in the users file - simple check items (use huntgroups for your NAS addresses) with LDAP groups. match the good stuff, set reply match the bad stuff, set reject. alan
This is the answer. Also, this is much easier than what I was trying to do. Thank you for the pointer, Alan. -Scott On 3/26/12 5:17 PM, "Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> wrote:
hi,
a quick glance at your question and i'd say you be better off using simple entries in the users file - simple check items (use huntgroups for your NAS addresses) with LDAP groups.
match the good stuff, set reply
match the bad stuff, set reject.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Scott McLane Gardner wrote:
Sent: Tuesday, March 27, 2012 9:34 AM To: FreeRadius users mailing list Subject: Re: load balancing and if statements
This is the answer. Also, this is much easier than what I was trying to do. Thank you for the pointer, Alan.
-Scott
I'd be surprised if using Ldap-Group in the user's file resulted in load balancing of the group membership queries to the LDAP servers. Does it?
Brian Julin wrote:
I'd be surprised if using Ldap-Group in the user's file resulted in load balancing of the group membership queries to the LDAP servers. Does it?
It doesn't.
Alan DeKok.
So, now I'm confused again. If this doesn¹t load balance, then how should I really be going about this?
So, is the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 incorrect, or is it only correct for the very latest version? -Scott
Scott McLane Gardner wrote:
So, is the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 incorrect, or is it only correct for the very latest version?
It's correct. You're missing the point. That documentation is for calling MODULES. The configuration files have lists of MODULES, which are managed in sections. Sections can be if/else/etc. LDAP-Group is an ATTRIBUTE. Reading the MODULE documentation figure out how an ATTRIBUTE works is WRONG. Alan DeKok.
Hi,
So, is the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 incorrect, or is it only correct for the very latest version?
its correct.... you want to load balance the requests to the LDAP servers, yes? so whats the load balancing of the LDAP-Group attribute bit that you are stuck on? isnt that group....and the NAS check..valid no matter which LDAP server was talked to? If so, then use either users file (basic, simple) or policy (slightly more complex) to allow access from those NAS addresses when that group is present. one is a source of info, one is a variable from that source. alan
Alan DeKok wrote: Scott McLane Gardner wrote:
So, now I'm confused again. If this doesn¹t load balance, then how should I really be going about this?
It's hard.
Actually, on some further reading, it might not be: the LDAP library/DNS may take care of this instead of requiring special attention on the FreeRADIUS end. Firstly, for redundancy (and I tested this and it seems to work) ldap_init allows a space separated list of hostnames which will be tried in order. FreeRADIUS just passes this string through and the LDAP libraries seem to be happy about that. The only rough edge is, cosmetically, the debug log statement appends ":<port>" which ends up looking like the port designation belongs just to the last host. There might also be trouble between FreeRADIUS config syntax (with separate port) and the fact that the LDAP libraries also allow ":<port>" appendixes on each of the space-separated hostnames; that I did not test. For load-balancing (this I have not tested) a round-robin DNS for the LDAP servername may result in connections load balancing. Really this depends on the DNS caching behavior inside the LDAP library and on the host OS, but my impression is that by and large LDAP libraries treat DNS lookups sanely as a volatile item that needs to be re-loaded on re-use (there are Mozilla tickets wrestling with this for their LDAP re-implementation some years back, so even that lib might be OK.) At worst FreeRADIUS might need to add some fuzzing/connection-limits so that connections are regularly torn down and re-established, but not all at once, to force multiple DNS lookups when the server is started/hupped. If someone needs finer grained balancing, perhaps randomizing the connection pool selection may be needed. Also not tested is the space-separated multi-url form that goes through ldap_initialize instead of ldap_init, but openldap docs say that is supported as well. So if that works, the only reason someone would still need to do r-l-m tricks is if they need to validate TLS certs and the LDAP servers are not presenting the round-robin name and cannot be fixed to do so.
Scott McLane Gardner
I'd be surprised if using Ldap-Group in the user's file resulted in load balancing of the group membership queries to the LDAP servers. Does it?
It does, actually. Or at least it appears to. The first time it used ldap2 and the second time it used ldap1.
Probably you are seeing the auth checks load balance while the group membership checks are not.
On 27/03/12 15:07, Scott McLane Gardner wrote:
I'd be surprised if using Ldap-Group in the user's file resulted in load balancing of the group membership queries to the LDAP servers. Does it?
It does, actually. Or at least it appears to. The first time it used ldap2 and the second time it used ldap1.
Are you sure about that? It shouldn't work that way.
On Mon, 26 Mar 2012 11:46:22 -0700 Scott McLane Gardner <sgardne@uark.edu> wrote:
If I can't use if statements in a load balance block, can anyone suggest another way to go about accomplishing what I want to do here?
After reading this thread and realizing it affects my implementation (though with mysql), I started poking at this to work out a solution. The real problem with trying to build this in unlang is that there doesn't seem to be a way to differentiate between a failed Sql-Group check and a negative result. Instead, I have to cheese it out with an XLAT no-op to see if the SQL server is responding. If I'm missing something useful here, please let me know. I'd love some feedback from the gurus. Anyway, the config bits: policy { # ... mysql-1-disabled { if("%{mysql-1:SELECT 'test'}" != "test") { fail } if(mysql-1-Sql-Group == "disabled") { reject } else { ok } } mysql-2-disabled { if("%{mysql-2:SELECT 'test'}" != "test") { fail } if(mysql-2-Sql-Group == "disabled") { reject } else { ok } } } instantiate { # ... redundant-load-balance sql-disabled { mysql-1-disabled mysql-2-disabled } } Once this is in, "sql-disabled" can be placed in an authorize{} block. I really wish there was a better way to do this...
On 27/03/12 23:38, Brian De Wolf wrote:
On Mon, 26 Mar 2012 11:46:22 -0700 Scott McLane Gardner<sgardne@uark.edu> wrote:
If I can't use if statements in a load balance block, can anyone suggest another way to go about accomplishing what I want to do here?
After reading this thread and realizing it affects my implementation (though with mysql), I started poking at this to work out a solution.
The real problem with trying to build this in unlang is that there doesn't seem to be a way to differentiate between a failed Sql-Group check and a negative result. Instead, I have to cheese it out with
Correct. This is a limitation of the server internal API.
an XLAT no-op to see if the SQL server is responding. If I'm missing something useful here, please let me know. I'd love some feedback from the gurus. Anyway, the config bits:
Your "noop" SQL test is a reasonable solution.
I really wish there was a better way to do this...
It's hard. If you want to work on introducing a success/fail return value from xlat/paircompare handlers, it would go a long way to solving it.
participants (6)
-
Alan Buxey -
Alan DeKok -
Brian De Wolf -
Brian Julin -
Phil Mayers -
Scott McLane Gardner