LDAP operations error

[Alan DeKok]

On Jan 9, 2018, at 8:11 PM, Tom King via Freeradius-Users <freeradius-users at lists.freeradius.org> wrote:
> 
> I am sure this question has been asked many times over, so please point me to a thread if it's already answered.
> 
> We are connected to an AD-backed LDAP service.

  AD is unfortunately a *terrible* LDAP server.

> I've configured these two options in the ldap module config:
> Chase_referrals=yes
> Rebind=yes

  That's good...

> LDAP authentication is fine for about 10 minutes. After a while, freeradius LDAP authentication begins failing:
> ...
>  [ldap] performing search in dc=redacted,dc=Redacted,dc=com, with filter (SamAccountName=redacted-user)
> WARNING: Please set 'chase_referrals=yes' and 'rebind=yes'
> WARNING: See the ldap module configuration for details

  I've fixed the code in 3.0.16 so that it doesn't print this complaint if you've already set those flags.

>  [ldap] ldap_search() failed: Operations error

  That's an LDAP server error.  Your LDAP server doesn't like you.

  It's *usually* because the account does not have permission to read the data it's querying/

> It works fine for a while - what causes it to fail after a while?

  Active Directory magic?

  FreeRADIUS does LDAP queries.  If the back-end randomly decides to fail, there isn't much you can do to FreeRADIUS to fix the problem.

  The choices are:

1) use a query which always succeeds, no matter what back-end you're using

2) use a back-end that doesn't suck

 :(

> Does having a loadbalancer in front of the LDAP server make a difference?

  Maybe.  If the back-end databases are *not* all identical, then load-balancing to one will give you "operations error", while load-balancing to another one will work.

  Alan DeKok.