LDAP Server Connections Closing Immediately
Hello All, It appears that the LDAP pool configuration isn't reusing the LDAP connections as configured. I am running the following version of FreeRADIUS:
FreeRADIUS Version 3.0.12 (git #34f7ba7), built on Apr 6 2016 at 08:07:17
Below is the debug output of the pool initialization:
rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful
Debug Output: rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://ForestDnsZones.<domain>/DC=ForestDnsZones,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://<domain>/CN=Configuration,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (7) Search returned no results (7) Checking user object's memberOf attributes (7) Waiting for bind result... (7) Bind successful (7) Performing unfiltered search in "<user-DN>", scope "base" (7) Waiting for search result... (7) No group membership attribute(s) found in user object rlm_ldap (ldap): Deleting connection (2) (7) User is not a member of "BOE" (7) Searching for user in group "Admin-Users" rlm_ldap (ldap): Reserved connection (3) (7) Using user DN from request "<user-DN>" (7) Checking for user in group objects (7) EXPAND (&(cn=Admin-Users)(objectClass=group)(&(objectClass=group)(member=%{Ldap-UserDn}))) (7) --> (&(cn=Admin-Users)(objectClass=group)(&(objectClass=group)(member=))) (7) Performing search in "<domain>" with filter "(&(cn=Admin-Users)(objectClass=group)(&(objectClass=group)(member=)))", scope "sub" (7) Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap://DomainDnsZones.<domain>/DC=DomainDnsZones,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://ForestDnsZones.<domain>/DC=ForestDnsZones,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://<domain>/CN=Configuration,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (7) Search returned no results (7) Checking user object's memberOf attributes (7) Waiting for bind result... (7) Bind successful (7) Performing unfiltered search in "<user-DN>", scope "base" (7) Waiting for search result... (7) No group membership attribute(s) found in user object rlm_ldap (ldap): Deleting connection (3) (7) User is not a member of "Admin-Users" (7) Searching for user in group "Admin-Computers" rlm_ldap (ldap): Reserved connection (4) (7) Using user DN from request "<user-DN>" (7) Checking for user in group objects (7) EXPAND (&(cn=Admin-Computers)(objectClass=group)(&(objectClass=group)(member=%{Ldap-UserDn}))) (7) --> (&(cn=Admin-Computers)(objectClass=group)(&(objectClass=group)(member=))) (7) Performing search in "<domain>" with filter "(&(cn=Admin-Computers)(objectClass=group)(&(objectClass=group)(member=)))", scope "sub" (7) Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap://DomainDnsZones.<domain>/DC=DomainDnsZones,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://ForestDnsZones.<domain>/DC=ForestDnsZones,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://<domain>/CN=Configuration,DC=DC=<domain> rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (7) Search returned no results (7) Checking user object's memberOf attributes (7) Waiting for bind result... (7) Bind successful (7) Performing unfiltered search in "<user-DN>", scope "base" (7) Waiting for search result... (7) No group membership attribute(s) found in user object rlm_ldap (ldap): Deleting connection (4) -- Jonathan Gryak Infrastructure Manager Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211
On Apr 13, 2016, at 11:23 AM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
It appears that the LDAP pool configuration isn't reusing the LDAP connections as configured.
What does that mean? There is no configuration which says "re-use LDAP connections". It just uses connections from a pool.
Below is the debug output of the pool initialization:
Which shows it making connections...
Debug Output: rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://ForestDnsZones.<domain>/DC=ForestDnsZones,DC=DC=<domain>
And... you're running Active Directory. When the LDAP module gets a redirect from Active Directory, it connects to the other LDAP server. It does this by re-connecting the existing LDAP connection, instead of creating a new one. The server is working as designed. Alan DeKok.
Hello Alan, Thank you for the response. I may have truncated the debug output too soon. After the 4 connections are used, the following output appears for each LDAP connection in the same request (notice that the number of slots reverts back to 32):
(7)... rlm_ldap (ldap): Reserved connection (5) (7)... rlm_ldap (ldap): Deleting connection (5) (7)... rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://tso-auth00.westport.k12.ct.us:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (6) ((7)... rlm_ldap (ldap): Deleting connection (6) (7)... rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (7), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (7) (7)... rlm_ldap (ldap): Deleting connection (7) (7)... rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (8), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://<server>:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (8) (7)... rlm_ldap (ldap): Deleting connection (8) (7)... rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
On Wed, Apr 13, 2016 at 11:32 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 13, 2016, at 11:23 AM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
It appears that the LDAP pool configuration isn't reusing the LDAP connections as configured.
What does that mean? There is no configuration which says "re-use LDAP connections". It just uses connections from a pool.
Below is the debug output of the pool initialization:
Which shows it making connections...
Debug Output: rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap://ForestDnsZones.<domain>/DC=ForestDnsZones,DC=DC=<domain>
And... you're running Active Directory.
When the LDAP module gets a redirect from Active Directory, it connects to the other LDAP server. It does this by re-connecting the existing LDAP connection, instead of creating a new one.
The server is working as designed.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jonathan Gryak Infrastructure Manager Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211
On Apr 13, 2016, at 2:24 PM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
Hello Alan, Thank you for the response. I may have truncated the debug output too soon. After the 4 connections are used, the following output appears for each LDAP connection in the same request (notice that the number of slots reverts back to 32):
That isn't answering my question. I said:
What does that mean? There is no configuration which says "re-use LDAP connections". It just uses connections from a pool.
So what is going *wrong*? I already explained why it's closing connections. Did you understand that? Or do you think something *else* is going wrong? So far all you're doing is saying "it says something about 32 connections". Well... yes. So? Alan DeKok.
Hi Alan, Sorry for not elaborating. I was primarily concerned with the debug message: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" I suppose that I would expect the slot count in the pool to decrease or increase with each connection used, as when the server initially starts up the number of available slots decreases from 32 to 28. Regarding the "re-use LDAP connections", I thought the lifetime=0 setting would mean that an existing slot would used, and that slot would be indicated in the debug output for each LDAP connection. I though perhaps that the "1 of 32 pending slots used" message indicated that a new thread was being created each time, rather than reusing one from the pool. On Wed, Apr 13, 2016 at 2:40 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 13, 2016, at 2:24 PM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
Hello Alan, Thank you for the response. I may have truncated the debug output too soon. After the 4 connections are used, the following output appears for each LDAP connection in the same request (notice that the number of slots reverts back to 32):
That isn't answering my question. I said:
What does that mean? There is no configuration which says "re-use LDAP connections". It just uses connections from a pool.
So what is going *wrong*?
I already explained why it's closing connections. Did you understand that? Or do you think something *else* is going wrong?
So far all you're doing is saying "it says something about 32 connections".
Well... yes. So?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jonathan Gryak Infrastructure Manager Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211
On Apr 13, 2016, at 2:50 PM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
Sorry for not elaborating. I was primarily concerned with the debug message: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
OK...
I suppose that I would expect the slot count in the pool to decrease or increase with each connection used, as when the server initially starts up the number of available slots decreases from 32 to 28.
As I explained. When the LDAP module gets a redirect from Active Directory, it connects to the other LDAP server. It does this by re-connecting the existing LDAP connection, instead of creating a new one. Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server. So the LDAP module closes the connection.
Regarding the "re-use LDAP connections", I thought the lifetime=0 setting would mean that an existing slot would used, and that slot would be indicated in the debug output for each LDAP connection.
The meaning and function of "lifetime=0" is documented in the config files. Read them to see how it works.
I though perhaps that the "1 of 32 pending slots used" message indicated that a new thread was being created each time, rather than reusing one from the pool.
If you read the debug output, you would see what I explained. It grabs a connection from the pool. The connection is used to talk to AD. AD returns a redirect to another LDAP server. Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server. So the LDAP module closes the connection. Alan DeKok.
Alan, Thank you very much for taking the time to explain this. Best, Jonathan On Wed, Apr 13, 2016 at 3:33 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 13, 2016, at 2:50 PM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
Sorry for not elaborating. I was primarily concerned with the debug message: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
OK...
I suppose that I would expect the slot count in the pool to decrease or increase with each connection used, as when the server initially starts up the number of available slots decreases from 32 to 28.
As I explained. When the LDAP module gets a redirect from Active Directory, it connects to the other LDAP server. It does this by re-connecting the existing LDAP connection, instead of creating a new one.
Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server.
So the LDAP module closes the connection.
Regarding the "re-use LDAP connections", I thought the lifetime=0 setting would mean that an existing slot would used, and that slot would be indicated in the debug output for each LDAP connection.
The meaning and function of "lifetime=0" is documented in the config files. Read them to see how it works.
I though perhaps that the "1 of 32 pending slots used" message indicated that a new thread was being created each time, rather than reusing one from the pool.
If you read the debug output, you would see what I explained. It grabs a connection from the pool. The connection is used to talk to AD. AD returns a redirect to another LDAP server.
Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server.
So the LDAP module closes the connection.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jonathan Gryak Infrastructure Manager Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211
Jonathon,
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+jmdanner=samford.edu@lists.freeradius.org] On Behalf Of Jonathan Gryak Sent: Wednesday, April 13, 2016 2:44 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: LDAP Server Connections Closing Immediately
Alan, Thank you very much for taking the time to explain this.
Best, Jonathan
On Wed, Apr 13, 2016 at 3:33 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 13, 2016, at 2:50 PM, Jonathan Gryak <jgryak@westport.k12.ct.us> wrote:
Sorry for not elaborating. I was primarily concerned with the debug message: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
OK...
I suppose that I would expect the slot count in the pool to decrease or increase with each connection used, as when the server initially starts up the number of available slots decreases from 32 to 28.
As I explained. When the LDAP module gets a redirect from Active Directory, it connects to the other LDAP server. It does this by
You can dispense with the redirects, if not serving multiple domains, by pointing LDAP to the global catalog ports of the domain controller. ldap 3268 ldaps 3269 You'll have to get with your AD admins to insure that the attributes you need are exposed to the Global Catalog.
re-connecting the existing LDAP connection, instead of creating a new one.
Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server.
So the LDAP module closes the connection.
Regarding the "re-use LDAP connections", I thought the lifetime=0 setting would mean that an existing slot would used, and that slot would be indicated in the debug output for each LDAP connection.
The meaning and function of "lifetime=0" is documented in the config files. Read them to see how it works.
I though perhaps that the "1 of 32 pending slots used" message indicated that a new thread was being created each time, rather than reusing one from the pool.
If you read the debug output, you would see what I explained. It grabs a connection from the pool. The connection is used to talk to AD. AD returns a redirect to another LDAP server.
Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server.
So the LDAP module closes the connection.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jonathan Gryak Infrastructure Manager
Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the tip Mearl. On Wed, Apr 13, 2016 at 3:50 PM, Danner, Mearl <jmdanner@samford.edu> wrote:
Jonathon,
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users- bounces+jmdanner=samford.edu@lists.freeradius.org] On Behalf Of Jonathan Gryak Sent: Wednesday, April 13, 2016 2:44 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org
Subject: Re: LDAP Server Connections Closing Immediately
Alan, Thank you very much for taking the time to explain this.
Best, Jonathan
On Wed, Apr 13, 2016 at 3:33 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 13, 2016, at 2:50 PM, Jonathan Gryak <jgryak@westport.k12.ct.us
wrote:
Sorry for not elaborating. I was primarily concerned with the debug message: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
OK...
I suppose that I would expect the slot count in the pool to decrease or increase with each connection used, as when the server initially starts up the number of available slots decreases from 32 to 28.
As I explained. When the LDAP module gets a redirect from Active Directory, it connects to the other LDAP server. It does this by
You can dispense with the redirects, if not serving multiple domains, by pointing LDAP to the global catalog ports of the domain controller. ldap 3268 ldaps 3269
You'll have to get with your AD admins to insure that the attributes you need are exposed to the Global Catalog.
re-connecting the existing LDAP connection, instead of creating a new one.
Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server.
So the LDAP module closes the connection.
Regarding the "re-use LDAP connections", I thought the lifetime=0 setting would mean that an existing slot would used, and that slot would be indicated in the debug output for each LDAP connection.
The meaning and function of "lifetime=0" is documented in the config files. Read them to see how it works.
I though perhaps that the "1 of 32 pending slots used" message indicated that a new thread was being created each time, rather than reusing one from the pool.
If you read the debug output, you would see what I explained. It grabs a connection from the pool. The connection is used to talk to AD. AD returns a redirect to another LDAP server.
Since the existing connection is now pointing to a DIFFERENT ldap server, it's not connected to the MAIN ldap server.
So the LDAP module closes the connection.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jonathan Gryak Infrastructure Manager
Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jonathan Gryak Infrastructure Manager Westport Public Schools Technology Center 136 Riverside Avenue Westport, CT 06880 (203) 341-1211
participants (3)
-
Alan DeKok -
Danner, Mearl -
Jonathan Gryak