Multiple ldap instances - User Group Membership search not done

[Alan DeKok]

On Feb 27, 2019, at 5:05 AM, Florian Sus | indevis GmbH <florian.sus at indevis.de> wrote:
> 
> I have a question regarding multiple ldap instances in freeradius and searching users in LDAP-Groups.
> 
> First of all, what do I try to achieve:
> Freeradius has to authenticate and authorize our admin users for our customers network devices.
> It has to perform user authentication with a simple ldap bind authentication and look up the group membership of the user.
> If the password of the user is correct and the user is member of a specific group, access shall be granted.
> I have already achieved a working configuration for the tasks above.

  That's good.

> I recently got a new task to allow also our customers access to their network devices with read-only access.
> The customer users are already configured in another ldap server.
> So I would like to configure two named ldap instances in rlm_ldap.

  No, you should add a *different* named instance of the LDAP module.  Don't break things that work.  Don't rename the existing (and working) LDAP module.

  And how do you tell the difference between the two groups of users?  This is a key question which you've left unresolved.

  What happens if *both* LDAP servers have a user named "bob"?  Which one gets access?

> If I do so, the authentication part for the admin user still works, but freeradius will not search the LDAP for user membership anymore and reject access.
> Please find below the config and debug output of the working configuration with only one ldap server
> And the modified config with two named ldap instances.

  Don't post config files to the list.  When you join the list, you get an email saying this.

  Your message is typical of a complex process: "I'm not sure what I"m doing, so I did a huge amount of work, and sent a huge description of what I've done".  Most of that effort is unproductive.

  Go back to the *working* configuration.

  Then, add a *new* LDAP module:

ldap ldap2 {
	...
}

  Just adding a new LDAP module won't break anything.

  Then, figure out how to tell the difference between the two sets of users.  This is really the key question that will drive the solution.  Without that answer, it's impossible to advise on a good solution.

  Are the names different?  Do the users log into two different sets of devices?

  i.e. how does it work, and what do you want it to do?

  Alan DeKok.