Hello, Is there any limit on how many groups can be cached via ldap module? I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses. This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile. ldap module ---------------- ldap haproxy-dc { server = 172.16.7.230 port = 389 identity = 'CN=Administrator,CN=Users,dc=mydc,dc=net' password = ****** base_dn = 'dc=mydc,dc=net' group_dn = 'OU=GRUPOS,dc=mydc,dc=net' user { base_dn = "OU=USUARIOS,${..base_dn}" filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_positive = yes } group { base_dn = "OU=GRUPOS,${..base_dn}" filter = "(objectClass=group)" scope = 'base' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberOf' cacheable_name = 'no' cacheable_dn = 'yes' cache_attribute = 'LDAP-Group' } options { chase_referrals = yes rebind = yes res_timeout = 20 srv_timelimit = 20 net_timeout = 10 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } freeradius version: 3.2
On 22/05/2023 17:12, dextá wrote:
Is there any limit on how many groups can be cached via ldap module?
There is no specific limit within FreeRADIUS. You are best running FreeRADIUS in debug mode to see what is happening (or using radmin to capture debug output for that specific user).
I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses.
That is a lot - but should just result in 80 instances of the cached group attribute being created
This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile.
Debug output is the way to confirm or deny suspicions.
membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberOf' Having both membership_filter and membership_attribute will be increasing the load on your directory and the number of queries being sent.
If a user's group membership can be entirely defined using the memberOf attribute in their object, then just set that and comment out membership_filter. The group membership determined by membership_attribute is fetched at the same time as the user's DN is found. Membership found using membership_filter is a separate query once the user has been found - and should only be used if group membership can't be determined using membership_attribute. Nick
On May 22, 2023, at 12:12 PM, dextá <dexter7bbot@gmail.com> wrote:
Is there any limit on how many groups can be cached via ldap module?
The limit is 64. See LDAP_MAX_CACHEABLE in the source.
I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses.
This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile.
Perhaps also read the debug output as suggested by all o the documentation. The debug output will show which groups matched. You can use that information to see if the group exists in LDAP, but isn't being matched in FreeRADIUS. If so, it's likely due to the LDAP_MAX_CACHEABLE flag. Alan DeKok.
The limit is 64. See LDAP_MAX_CACHEABLE in the source.
Ok. Thanks!! Having both membership_filter and membership_attribute will be
increasing the load on your directory and the number of queries being sent.
I commented out the membership_attribute and corrected the membership_filter and now at first it is getting only the groups determined in a specific OU that I configured and connecting correctly on the wifi. I appreciate the help from both of you! Em seg., 22 de mai. de 2023 às 13:42, Alan DeKok <aland@deployingradius.com> escreveu:
On May 22, 2023, at 12:12 PM, dextá <dexter7bbot@gmail.com> wrote:
Is there any limit on how many groups can be cached via ldap module?
The limit is 64. See LDAP_MAX_CACHEABLE in the source.
I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses.
This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile.
Perhaps also read the debug output as suggested by all o the documentation.
The debug output will show which groups matched. You can use that information to see if the group exists in LDAP, but isn't being matched in FreeRADIUS. If so, it's likely due to the LDAP_MAX_CACHEABLE flag.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
dextá -
Nick Porter