Failure to reconnect to ldaps server after idle_timeout

[Arran Cudbard-Bell]

> On 11 Mar 2015, at 11:33, Alan DeKok <aland at deployingradius.com> wrote:
> 
> On Mar 11, 2015, at 11:30 AM, Graham Leggett <minfrin at sharp.fm> wrote:
>> I don’t follow - how does libldap work with software like httpd, but not work with freeradius?
>  Many of the other users open connections and keep them open, or open connections in a child process.  Not many use multiple threads and open/close connections.

It's because mod_ldap uses a global SSL configuration context.

We use per connection configuration contexts, as that's the only way to ensure the module
instance specific TLS parameters are honoured.

If you attempted to use multiple TLS certificates with mod_ldap you would likely find that
it did not work at intended.

If you tried the same configuration with FreeRADIUS, it would work as intended.

The mod_ldap code is available here:

	http://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ldap/util_ldap.c

The github issue describes the root cause in greater detail:

	https://github.com/FreeRADIUS/freeradius-server/pull/866

This seems like an NSS defect TBH. It should do reference counting for its modules, to
ensure they're not referenced by multiple contexts, so that they're not unintentionally
unloaded when contexts are freed.

TL;DR mod_ldap is broken in other ways which happens to mask this issue.

Arran Cudbard-Bell <a.cudbardb at freeradius.org>
FreeRADIUS development team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 872 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20150311/3de2bddb/attachment.sig>