radius + rlm_ldap: alter auth-type if server not reachable
Hi, I'm currently using FreeRADIUS v2.1.7 with OpenLDAP v2.3.43 as back-end. After already reading numerous times that ldap failover doesn't work/isn't implemented in the rlm_ldap I had to find another way to provide HA. Currently I'm pointing towards 2 radius servers, each configured with a different ldap server. The problem I'm having is that the radius sends an explicit reject when it can't connect to ldap. This is problematic since the requester will reject the user, instead of trying to contact the second radius. Is there a way to catch the "Can't contact LDAP server"/rlm_fail and send no response at all in that case? From a requester perspective it would be much cleaner to get no response at all (and trying the 2nd radius server) then getting a reject. Br, Thomas
Hi, I found a reference in the mailing list now (must have used the wrong search parameters before) with a hint: http://lists.cistron.nl/pipermail/freeradius-users/2011-April/msg00450.html But it still returns a REJECT -> " Using Post-Auth-Type Reject" In the authorize section of sites-enabled/default I have put " ldap { fail = 1 } if (fail) { do_not_respond }" Radius -X returns the following when the ldap server is down: ++[ldap] returns fail ++? if (fail) ? Evaluating (fail) -> TRUE ++? if (fail) -> TRUE ++- entering if (fail) {...} +++- entering policy do_not_respond {...} ++++[control] returns fail ++++[handled] returns handled +++- policy do_not_respond returns handled ++- if (fail) returns handled Using Post-Auth-Type Reject +- entering group REJECT {...} What am I missing here? Br, Thomas
+++- policy do_not_respond returns handled ++- if (fail) returns handled Using Post-Auth-Type Reject +- entering group REJECT {...}
Weird... that should work. Have you tried with a more recent version of FR? -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
Not yet tried it with a more recent version (trying to stick to the OS-packages). I did was able to get it working by modifying the policy.conf file to: do_not_respond { update control { Response-Packet-Type := Do-Not-Respond Auth-Type := Accept } handled } Then it doesn't send a reply when the ldap is down Br, Thomas -----Original Message----- From: freeradius-users-bounces+thomas=dupas.be@lists.freeradius.org [mailto:freeradius-users-bounces+thomas=dupas.be@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: maandag 22 augustus 2011 12:05 To: FreeRadius users mailing list Subject: Re: radius + rlm_ldap: alter auth-type if server not reachable
+++- policy do_not_respond returns handled ++- if (fail) returns handled Using Post-Auth-Type Reject +- entering group REJECT {...}
Weird... that should work. Have you tried with a more recent version of FR? -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Arran Cudbard-Bell -
Thomas Dupas