freeradius 3.0.15 not tarting if one LDAP server not reachable
Hi, We are running freeradius with authentication against several LDAP clusters (2-node): Example config: Auth-Type LDAP_CMS { redundant-load-balance { # between ldap servers ldap_cms1 ldap_cms2 } } If one of those ldap servers (i.e. ldap_cms2) can't be reached (temporary failure, maintenance, ...), freeradius won't start: Thu Dec 14 21:05:31 2017 : Error: rlm_ldap (ldap_cms2): Could not start TLS: Can't contact LDAP server Thu Dec 14 21:05:31 2017 : Error: rlm_ldap (ldap_cms2): Opening connection failed (0) Thu Dec 14 21:05:31 2017 : Error: /usr2/freeradius/etc/raddb/mods-enabled/ldap[844]: Instantiation failed for module "ldap_cms2" Thu Dec 14 21:05:36 2017 : Info: Debugger not attached Are there any ideas how to work around this problem? Looking at the code rlm_ldap instantiation would fail, if there is any problem. If freeradius is already running, there is no problem with a failing ldap server. But a freeradius restart in such a situation means a full service failure (even if only one of 8 ldap servers is down). @devs: Do you think error handling could be extended here to distinguish between temporary and permanent (configuration) errors? Or would this add too much complexity? I assume, this would be a too complex change for 3.x. At this point in time we don't know, that there will be a redundant config for this authentication source. Should I open a bug for this? Kind regards, Enno
in the ldap main module config is an option which lets you start up with 0 connections. that allows the server to continue if it cannot connect at startup alan
On Dec 15, 2017, at 9:01 AM, Enno Gröper <groepeen@cms.hu-berlin.de> wrote:
If one of those ldap servers (i.e. ldap_cms2) can't be reached (temporary failure, maintenance, ...), freeradius won't start:
Thu Dec 14 21:05:31 2017 : Error: rlm_ldap (ldap_cms2): Could not start TLS: Can't contact LDAP server Thu Dec 14 21:05:31 2017 : Error: rlm_ldap (ldap_cms2): Opening connection failed (0) Thu Dec 14 21:05:31 2017 : Error: /usr2/freeradius/etc/raddb/mods-enabled/ldap[844]: Instantiation failed for module "ldap_cms2" Thu Dec 14 21:05:36 2017 : Info: Debugger not attached
Are there any ideas how to work around this problem?
Set "start = 0" in the "pool" subsection of raddb/mods-enabled/ldap
Do you think error handling could be extended here to distinguish between temporary and permanent (configuration) errors?
How would you tell the difference between the two?
Or would this add too much complexity? I assume, this would be a too complex change for 3.x. At this point in time we don't know, that there will be a redundant config for this authentication source. Should I open a bug for this?
Nope. You can work around the issue using the standard configuration options. Alan DeKok.
participants (3)
-
Alan Buxey -
Alan DeKok -
Enno Gröper