[prev in list] [next in list] [prev in thread] [next in thread]
List: freeradius-users
Subject: Complex redundant ldap setup
From: "Capelle, Mark (PCMC-GB)" <Mark.Capelle () pcmc ! com>
Date: 2008-02-26 20:33:55
Message-ID: 12ED24B2537575458993F162D4CB3F6C43E9C1 () PcmcMxsUsr01 ! BWCINC ! ORG
[Download RAW message or body]
--===============0154709732==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C878B6.E8216472"
This is a multi-part message in MIME format.
I have an LDAP setup with multiple module statements pointing to the
same LDAP server, but at different OU's (referred to as sites) to get
around issues due to the large tree size present. This is currently
working with the following setup
radiusd.conf:
modules {
ldap srv1-sitea {
..
set_auth_type = yes
}
ldap srv1-siteb {
..
set_auth_type = yes
}
}
sites-available/default:
authorize {
srv1-sitea
srv1-siteb
}
authenticate {
Auth-Type srv1-sitea {
srv1-sitea
}
Auth-Type srv1-siteb {
srv1-siteb
}
}
Now my goal is to make this a redundant configuration. I have
duplicated my modules config, changing "srv1" to "srv2" and changing the
IP address of the LDAP server. The rest of the configuration is what is
fuzzy for me. I assume that my authorize section would be:
authorize {
redundant {
srv1-sitea
srv2-sitea
}
redundant {
srv1-siteb
srv2-siteb
}
Now the authentication part is where is becomes complicated. I don't
even know where to begin with this. I tried this based on some old
configs I had used in the past, but this failed miserably:
authenticate {
Auth-Type ldap {
group {
srv1-sitea {
reject = 1
ok = return
}
srv2-siteb {
reject = return
ok = return
}
}
}
I read the "configurable failover" docs, but it is still not clear to me
what I would need to do in this situation.
I am sure there is probably an easy way to accomplish this so that for
each OU ("site") it uses both LDAP servers ("srv1","srv2") in a
redundant fashion, but how to do it is something I am having a heck of a
time figuring out.
[Attachment #3 (text/html)]
<html xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I have an LDAP setup with multiple module statements
pointing to the same LDAP server, but at different OU’s (referred to as
sites) to get around issues due to the large tree size present. This is
currently working with the following setup<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>radiusd.conf:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>modules {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
ldap srv1-sitea {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
..<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
set_auth_type = yes<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
ldap srv1-siteb {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
..<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
set_auth_type = yes<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>sites-available/default:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>authorize {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
srv1-sitea<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
srv1-siteb<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>authenticate {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
Auth-Type srv1-sitea {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>srv1-sitea<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>Auth-Type srv1-siteb \
{<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>srv1-siteb<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Now my goal is to make this a redundant configuration.
I have duplicated my modules config, changing “srv1” to \
“srv2” and changing the IP address of the LDAP server. The rest of \
the configuration is what is fuzzy for me. I assume that my authorize section
would be:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>authorize {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
redundant {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>srv1-sitea<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
\
srv2-sitea<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
redundant {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
\
srv1-siteb<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
\
srv2-siteb<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Now the authentication part is where is becomes complicated.
I don’t even know where to begin with this. I tried this based on
some old configs I had used in the past, but this failed \
miserably:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>authenticate {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> Auth-Type ldap \
{<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
group {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
srv1-sitea {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
reject = 1<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
ok = return<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
srv2-siteb {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
reject = return<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
ok = return<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> \
}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I read the “configurable failover” docs, but it
is still not clear to me what I would need to do in this \
situation.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I am sure there is probably an easy way to accomplish this
so that for each OU (“site”) it uses both LDAP servers \
(“srv1”,”srv2”) in a redundant fashion, but how to do it is \
something I am having a heck of a time figuring out.<o:p></o:p></span></font></p>
</div>
</body>
</html>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--===============0154709732==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic