Referencing a redundant-load-balance set within users file
Version: freeradius-2.1.1 I cannot get a redundant-load-balance set to work within a variable expansion in the users file. I added this to the bottom of the instantiate section of radiusd.conf: redundant-load-balance redundant_ldap { ldap1 ldap2 ldap3 } and this to the authorize section of sites-enabled/default: redundant_ldap and I defined the 3 ldap instances in modules/ldap, and this part works fine. But I cannot figure out how to reference redundant_ldap from within the users file. I tried Connect-Info = "%{redundant_ldap:ldap:///dc=rice,dc=edu?riceClass?sub?uid=%u}" but the debug output shows: WARNING: Unknown module "redundant_ldap" in string expansion "%{redundant_ldap:ldap:///dc=rice,dc=edu?riceClass?sub?uid=%u}" I attached the start of the debug output. The whole output was over the 100k limit. Tod Sandman Sr. Systems Administrator Middleware Development & Integration Rice University Voice: 713.348.5816
Version: freeradius-2.1.1
I cannot get a redundant-load-balance set to work within a variable expansion in the users file.
No. It's not a module, it's a group. You can list different modules inside the group - they don't have to be the same type (all ldap or all sql; they can be mixed).
I added this to the bottom of the instantiate section of radiusd.conf:
redundant-load-balance redundant_ldap { ldap1 ldap2 ldap3 }
and this to the authorize section of sites-enabled/default:
redundant_ldap
and I defined the 3 ldap instances in modules/ldap, and this part works fine.
But I cannot figure out how to reference redundant_ldap from within the users file.
I tried
Connect-Info = "%{redundant_ldap:ldap:///dc=rice,dc=edu?riceClass?sub?uid=%u}"
Why don't you map that in ldap.attrmap? Ivan Kalik Kalik Informatika ISP
Ivan Kalik wrote:
Why don't you map that in ldap.attrmap?
Thanks so much. I removed all LDAP settings from users, and I have TTLS-PAP working fine with redundant LDAP for authorization and Kerberos for Authentication. Now I can't get the only other mode we need: PEAP/MSChapv2. LDAP authorization is working fine, and the ntlm-auth authentication works fine, but required attributes are not being sent back in the Access-Accept packet. Unlike when I connect via TTLS-PAP, the Access-Accept does not include some required attributes. The debug output shows them getting set properly within sites-enabled/inner-tunnel and getting updated with "update outer.reply", but they get dropped before the Access-Accept packet. I haven't touched sites-enabled/default. I enabled ldap in sites-enabled/inner-tunnel, and afterwards I do an "update outer.reply", i.e.:, redundant-load-balance redundant_ldap { ldap1 ldap2 ldap3 } update outer.reply { Cisco-AVPair := "%{reply:Connect-Info}" Class := "OU=%{reply:Connect-Info}" } and the debug output shows this working. But the Access-Accept does not include these attributes as it does when I use TTLS-PAP. I tried moving the "update outer.reply" to the post-auth section, but this did not help. My config is quite close to the default. The only PEAP related change I made was to update modules/mschap with the correct ntlm_auth line. Thanks for any ideas. Tod Sandman Sr. Systems Administrator Middleware Development & Integration Rice University
Change use_tunneled_reply to yes in peap section of eap.conf. Ivan Kalik Kalik Informatika ISP Dana 14/11/2008, "Tod A. Sandman" <sandmant@rice.edu> piše:
Ivan Kalik wrote:
Why don't you map that in ldap.attrmap?
Thanks so much. I removed all LDAP settings from users, and I have TTLS-PAP working fine with redundant LDAP for authorization and Kerberos for Authentication.
Now I can't get the only other mode we need: PEAP/MSChapv2. LDAP authorization is working fine, and the ntlm-auth authentication works fine, but required attributes are not being sent back in the Access-Accept packet.
Unlike when I connect via TTLS-PAP, the Access-Accept does not include some required attributes. The debug output shows them getting set properly within sites-enabled/inner-tunnel and getting updated with "update outer.reply", but they get dropped before the Access-Accept packet.
I haven't touched sites-enabled/default.
I enabled ldap in sites-enabled/inner-tunnel, and afterwards I do an "update outer.reply", i.e.:,
redundant-load-balance redundant_ldap { ldap1 ldap2 ldap3 }
update outer.reply { Cisco-AVPair := "%{reply:Connect-Info}" Class := "OU=%{reply:Connect-Info}" }
and the debug output shows this working.
But the Access-Accept does not include these attributes as it does when I use TTLS-PAP.
I tried moving the "update outer.reply" to the post-auth section, but this did not help.
My config is quite close to the default. The only PEAP related change I made was to update modules/mschap with the correct ntlm_auth line.
Thanks for any ideas.
Tod Sandman Sr. Systems Administrator Middleware Development & Integration Rice University
participants (2)
-
tnt＠kalik.net -
Tod A. Sandman