Trying multiple realms
Is there any way to try multiple realms inside an update control statement? What I want to do is try proxying to one realm, and if that fails trying the credentials via the local ream. Thanks in advance. -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189@wayne.edu
Charles Plater wrote:
Is there any way to try multiple realms inside an update control statement? What I want to do is try proxying to one realm, and if that fails trying the credentials via the local ream. Thanks in advance.
Read raddb/proxy.conf. Look for the home server pool section. This works, and is documented. Alan DeKok.
On Jul 26, 2011, at 4:36 PM, Alan DeKok wrote:
Charles Plater wrote:
Is there any way to try multiple realms inside an update control statement? What I want to do is try proxying to one realm, and if that fails trying the credentials via the local ream. Thanks in advance.
Read raddb/proxy.conf. Look for the home server pool section.
This works, and is documented.
If I'm reading raddb/proxy.conf correctly home_server_pool allows for fail-over and load-balancing configurations. In my case I was to try the same credentials against multiple servers. I'm currently using this bit of unlang to send some requests to another radius server: if (User-Name !~ /^..[0-9][0-9][0-9].*$/) { update control { Proxy-To-Realm := 'med.wayne.edu' } } What I'm looking at doing is to retry failed proxy attempts locally. Is this possible? -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189@wayne.edu
Charles Plater wrote:
If I'm reading raddb/proxy.conf correctly home_server_pool allows for fail-over and load-balancing configurations.
Yes.
In my case I was to try the same credentials against multiple servers.
RADIUS doesn't do that. It's a *terrible* idea.
What I'm looking at doing is to retry failed proxy attempts locally. Is this possible?
*Please* use the correct terminology. Do you mean "failed", as in "failed to get a response", or "rejected", as in "received a reject packet"? If you use vague terminology, it's impossible to help you. The server treats rejects as being definitive. Changing them later to accepts is wrong and broken. Fix your design so that you send the packets to the correct server. Alan DeKok.
On 27 Jul 2011, at 17:14, Charles Plater wrote:
On Jul 26, 2011, at 4:36 PM, Alan DeKok wrote:
Charles Plater wrote:
Is there any way to try multiple realms inside an update control statement? What I want to do is try proxying to one realm, and if that fails trying the credentials via the local ream. Thanks in advance.
Read raddb/proxy.conf. Look for the home server pool section.
This works, and is documented.
If I'm reading raddb/proxy.conf correctly home_server_pool allows for fail-over and load-balancing configurations. In my case I was to try the same credentials against multiple servers. I'm currently using this bit of unlang to send some requests to another radius server:
if (User-Name !~ /^..[0-9][0-9][0-9].*$/) { update control { Proxy-To-Realm := 'med.wayne.edu' } }
What I'm looking at doing is to retry failed proxy attempts locally. Is this possible?
Fail in what way. Because a servers down or because the user was rejected? -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Charles Plater