[RADIATOR] AuthBy LDAP2 and FailureBackoffTime

[Jan Tomasek]

Hello,

I'm running two Radiator servers for authentication of our users in 
cesnet.cz realm on our eduroam WiFi. Each Radiator has a dedicated LDAP 
server. WiFi is controlled by a WLC. I expected that if any of RADIUSes 
fails WLC will fail back to another. That is true for the RADIUS server, 
but not for LDAP server failure.

In case there is the LDAP server failure, the Radiator returns 
access-reject for default FailureBackoffTime = 600s. WLC has no chance 
to discover that there is a problem because it receives a response and 
continues to send clients to the failing RADIUS server. Is there any 
chance how to not respond to request when AuthyBy LDAP2 fails?

Is there a chance to re-check failed LDAP server before 
FailureBackoffTime expires? When there is no remaining LDAP server in 
Host pool this waiting doesn't make much sense?

At this moment I reduced FailureBackoffTime from 600s to 60s and 
provided multiple LDAP servers to AuthBy LDAP2. Which seems to be working.

My config:

<AuthBy LDAP2>
         Identifier Check2017LDAP

         UsernameMatchesWithoutRealm yes

         Host                    ldap
         Port                    636
         UseSSL
         SSLCAFile               /etc/radiator/certs/chain_CESNET_CA4.pem
         FailureBackoffTime      60

         AuthDN                  xxxx
         AuthPassword            xxxx

         BaseDN                  dc=cesnet,dc=cz
         UsernameAttr            uid
         PasswordAttr            radiusPassword
         AuthAttrDef             radiusTunnelPrivateGroupID, 
Tunnel-Private-Group-ID, reply
         SearchFilter 
(&(%0=%1)(|(objectClass=eduroamTestAccount)(objectClass=radiusUser)))
         EAPType                 PEAP,MSCHAP-V2,LEAP,TTLS

         # 2. 11. 2018 Semik - prestavame posilat korenovy certifikat
         EAPTLS_CAPath           /etc/ssl/certs/null
         EAPTLS_CertificateFile  /etc/radiator/certs/radius.cesnet.cz.crt
         EAPTLS_CertificateType  PEM
         EAPTLS_PrivateKeyFile   /etc/radiator/certs/radius.cesnet.cz.key
         EAPTLS_PrivateKeyPassword xxxx
         EAPTLS_MaxFragmentSize  1000
         EAPTLS_SessionContextId %0%n%2%{Called-Station-Id}

         AutoMPPEKeys

         EAPTLS_PEAPVersion      0

         EAPAnonymous            %n

         SSLeayTrace             0
</AuthBy>

<Handler Realm=cesnet.cz, TunnelledByTTLS=1>
         AuthBy  Check2017LDAP
</Handler>

<Handler Realm=cesnet.cz, TunnelledByPEAP=1>
         AuthBy  Check2017LDAP
</Handler>

<Handler Realm=cesnet.cz>
         AuthBy  Check2017LDAP
         AuthLog authlogger
         AuthLog FTICKS-FULL

         AddToReplyIfNotExist    Tunnel-Type=1:VLAN,\
                                 Tunnel-Medium-Type=1:Ether_802
</Handler>

Best regards
-- 
-----------------------
Jan Tomasek aka Semik
http://www.tomasek.cz/