<div dir="ltr"><div dir="ltr"><div>Hello Dubravko</div><div><br>SASL authentication is an alternative to the default simple authentication (AuthDN and AuthPassword), it is not a connection method.<br><br>Radiator configuration expects the Host clause to have a DNS name or IP address, not a URL scheme. If Host is omitted, localhost is used as the default. Similarly, if Port is omitted (in your case, commented out), default 389 is used (as you saw from the logs).<br><br></div><div>I haven't tested it, so just a guess: Your old setup may have seemingly been working ok because on the old setup OpenLDAP server may have been responding to normal TCP connections on port 389 from localhost, and somehow this "Host ldapi:///" line (or you had it commented out) ended up being interpreted as not having a proper Host clause at all => use default: localhost.<br><br>As far as I know, Radiator doesn't support LDAP over IPC, and if it did (and if Host accepted the URI notation), you'd need to have the Unix socket file included in the URI, as Radiator wouldn't know the exact file path.</div><div><br></div><div>//jani</div><div><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 9 Apr 2026 at 09:21, Dubravko Penezic via radiator <<a href="mailto:radiator@lists.open.com.au" target="_blank">radiator@lists.open.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Hugh,<br>
<br>
lets start with possible solutions :<br>
<br>
Host ldapi\:\/\/\/<br>
<br>
return<br>
<br>
00000000 Thu Apr 9 07:43:53 2026 449514: INFO: AuthLDAP2 Connecting to <br>
ldapi\:\/\/\/ port 389<br>
<br>
and all other same response.<br>
<br>
That clarify that configuration value is passed RADIATOR engine as is <br>
without modification.<br>
<br>
Now return to ldapi:/// ...<br>
<br>
ldapi:/// (LDAP over IPC) - Instead of using TCP/IP (like ldap:// or <br>
ldaps://), ldapi:/// uses a local socket file, typically located at <br>
/var/run/ldapi or /var/run/openldap/ldapi/.<br>
<br>
The ldapi:/// protocol is often used with the SASL EXTERNAL mechanism<br>
<br>
EXTERNAL Mechanism: Because the connection is local, the client does not <br>
need a username or password. The SASL EXTERNAL mechanism allows the LDAP <br>
server to authenticate the user based on the Unix credentials (user ID, <br>
user Group ID) provided by the operating system kernel.<br>
<br>
Usually we use something like :<br>
<br>
ldapsearch -h ldapi:/// -Y EXTERNAL -b "cn=config"<br>
ldapvi -h ldapi:/// -Y EXTERNAL -b "cn=config"<br>
<br>
Now back to your second suggestion , that wouldnt work by design, but <br>
for complet all test I try also with<br>
<br>
Host ldapi://<a href="http://127.0.0.1/" rel="noreferrer" target="_blank">127.0.0.1/</a><br>
<br>
and got<br>
<br>
00000000 Thu Apr 9 07:55:19 2026 279828: ERR: AuthLDAP2 Could not open <br>
LDAP connection to ldapi://<a href="http://127.0.0.1/" rel="noreferrer" target="_blank">127.0.0.1/</a> port 389. Backing off for 60 seconds.<br>
<br>
I dint try with GlobalVar's because i dont see how that my improve <br>
upper tests.<br>
<br>
RADIATOR documentation have follow recomendation :<br>
"Also requires perl-ldap 0.33 and the Authen::SASL 2.09 module, or later."<br>
I check and both package are install.<br>
<br>
For follow have in mind I am not Perl expert ...<br>
<br>
I found pattern for error response in /opt/radiator/radiator/Radius/Ldap.pm<br>
line 410<br>
<br>
$self->log($main::LOG_ERR, "$self->{log_class_identifier} Could not open <br>
LDAP connection to $log_host_port. Backing off for <br>
$self->{FailureBackoffTime} seconds.");<br>
<br>
which follow to line 370<br>
<br>
$self->{ld} = Net::LDAP->new<br>
($server->{host},<br>
inet6 => $server->{useInet6},<br>
port => $port,<br>
timeout => $self->{Timeout},<br>
version => $self->{Version},<br>
multihomed => $self->{MultiHomed} ? 1 : 0,<br>
localaddr => $localaddr,<br>
);<br>
<br>
To me that dosnt look like proper way to connect to LDAP via SASL<br>
Also I found that SASL connection is prepare in line 568 .<br>
<br>
On other hand, I dont understand way that was work correctly before and <br>
stop working.<br>
<br>Dubravko<br>
<br>
On 4/9/26 3:45 AM, Hugh Irvine wrote:<br>
> <br>
> Hello Dubravko -<br>
> <br>
> It must be your Host declaration that is causing the problem - I haven't <br>
> seen this before "ldapi:///"<br>
> <br>
> Have you tried with just the IP address?<br>
> <br>
> Otherwise you could try escaping the special characters:<br>
> <br>
> Host ldapi\:\/\/\/<br>
> <br>
> You could also use Radiator GlobalVar's instead.<br>
> <br>
> Please let us know your results.<br>
> <br>> <br>
> Hugh<br>
> <br>
> <br>
> On 8/4/2026 17:18, Dubravko Penezic wrote:<br>
>> Hi Hugh,<br>
>><br>
>> configuration is follow :<br>
>><br>
>> Trace 4<br>
>> LogTraceId<br>
>> LogMicroseconds<br>
>> DbDir /etc/radiator<br>
>> LogDir /var/log/radiator<br>
>> LogFile %L/radiator-test.log<br>
>> AuthPort 1812<br>
>> AcctPort 1813<br>
>> DictionaryFile /opt/radiator/radiator/dictionary<br>
>> <Client 10.10.10.10><br>
>> Secret PeroPero<br>
>> StatusServer off<br>
>> </Client><br>
>><br>
>> <Realm DEFAULT><br>
>> RewriteUsername s/^(.+)(\.hs@)(mali\.hr)$/$1/i<br>
>> <AuthBy LDAP2><br>
>> Host ldapi:///<br>
>> # Port<br>
>> Timeout 5<br>
>> FailureBackoffTime 60<br>
>> UseSASL<br>
>> SASLMechanism EXTERNAL<br>
>> BaseDN %0=%1,dc=mali,dc=hr<br>
>> Scope base<br>
>> UsernameAttr uid<br>
>> ServerChecksPassword<br>
>> UnbindAfterServerChecksPassword<br>
>> AuthenProto PAP<br>
>> AuthAttrDef hrEduPersonExpireDate,Connect-Info,reply<br>
>> </AuthBy><br>
>> </Realm><br>
>><br>
>><br>
>> Debug log output is :<br>
>><br>
>> 00000000 Wed Apr 8 09:07:55 2026 569528: DEBUG: Radius::JSON backend <br>
>> is Cpanel::JSON::XS version 4.39<br>
>> 00000000 Wed Apr 8 09:07:55 2026 569652: DEBUG: SCTP socket API <br>
>> extensions not available<br>
>> 00000000 Wed Apr 8 09:07:55 2026 569705: DEBUG: Finished reading <br>
>> configuration file '/etc/radiator/radiator-test.conf'<br>
>> 00000000 Wed Apr 8 09:07:55 2026 729564: DEBUG: Radius::JSON backend <br>
>> is Cpanel::JSON::XS version 4.39<br>
>> 00000000 Wed Apr 8 09:07:55 2026 729669: DEBUG: SCTP socket API <br>
>> extensions not available<br>
>> 00000000 Wed Apr 8 09:07:55 2026 729718: DEBUG: Finished reading <br>
>> configuration file '/etc/radiator/radiator-test.conf'<br>
>> 00000000 Wed Apr 8 09:07:55 2026 729860: DEBUG: Reading RADIUS <br>
>> dictionary file '/opt/radiator/radiator/dictionary'<br>
>> 00000000 Wed Apr 8 09:07:55 2026 797863: INFO: Using Net::SSLeay 1.94 <br>
>> with SSL/TLS library version 0x30500050 (OpenSSL 3.5.5 27 Jan 2026)<br>
>> 00000000 Wed Apr 8 09:07:55 2026 797949: DEBUG: SSL/TLS library and <br>
>> Net::SSLeay support set_default_passwd_cb and related functions<br>
>> 00000000 Wed Apr 8 09:07:55 2026 798061: DEBUG: This system is IPv6 <br>
>> capable. IPv6 capability provided by: core<br>
>> 00000000 Wed Apr 8 09:07:55 2026 798171: WARNING: Startup check could <br>
>> not load Radius::UtilXS or Digest::MD4. See Radiator reference manual <br>
>> for DisabledRuntimeChecks parameter<br>
>> 00000000 Wed Apr 8 09:07:55 2026 798283: DEBUG: Creating <br>
>> authentication socket 0.0.0.0 port 1812<br>
>> 00000000 Wed Apr 8 09:07:55 2026 798423: DEBUG: Creating accounting <br>
>> socket 0.0.0.0 port 1813<br>
>> 00000000 Wed Apr 8 09:07:55 2026 798529: NOTICE: Server started: <br>
>> Radiator 4.30 on <a href="http://pero.mali.hr" rel="noreferrer" target="_blank">pero.mali.hr</a><br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 962489: DEBUG: Packet dump:<br>
>> 51c516c0 *** Received from 10.10.10.10 port 48750 ....<br>
>> 51c516c0 Code: Access-Request<br>
>> 51c516c0 Identifier: 135<br>
>> 51c516c0 Authentic: <br>
>> [<131><191><178>[<28><17><151><135><235>|)<205>W<249><189><br>
>> 51c516c0 Attributes:<br>
>> 51c516c0 Message-Authenticator = <br>
>> <150><131><133>zb<237><131>+y<230><178><8>x<171><158>H<br>
>> 51c516c0 User-Name = "<a href="mailto:pero@mali.hr" target="_blank">pero@mali.hr</a>"<br>
>> 51c516c0 User-Password = <br>
>> ji<155><5>)<194><206><143><152><176><223>(6<148><226><134><br>
>><br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 962720: DEBUG: Handling request with <br>
>> Handler 'Realm=DEFAULT', Identifier ''<br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 964567: DEBUG: Rewrote user name to <br>
>> <a href="mailto:pero@mali.hr" target="_blank">pero@mali.hr</a><br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 964699: DEBUG: SessINTERNAL: <br>
>> Deleting session for <a href="mailto:pero@mali.hr" target="_blank">pero@mali.hr</a>, 161.53.2.218,<br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 964785: DEBUG: Handling with <br>
>> Radius::AuthLDAP2:<br>
>> 00000000 Wed Apr 8 09:08:22 2026 964943: INFO: AuthLDAP2 Connecting <br>
>> to ldapi:/// port 389<br>
>> 00000000 Wed Apr 8 09:08:22 2026 965184: ERR: AuthLDAP2 Could not <br>
>> open LDAP connection to ldapi:/// port 389. Backing off for 60 seconds.<br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 965264: DEBUG: AuthBy LDAP2 result: <br>
>> IGNORE, User database access error<br>
>> 51c516c0 Wed Apr 8 09:08:22 2026 965349: DEBUG: Access ignored for <br>
>> <a href="mailto:pero@mali.hr" target="_blank">pero@mali.hr</a>: User database access error<br>>><br>
>> I did small redacted action on conf and log , but only on IP address, <br>
>> username parts.<br>
>><br>
>> From my point of view, RADIATOR code isnt able to connect to local <br>
>> LDAP service using SASL , dosnt meter what request contain. Bu I may <br>
>> be wrong.<br>
>><br>>> Dubravko<br>
>><br>
>><br>
>> On 4/8/26 7:37 AM, Dubravko Penezic via radiator wrote:<br>
>>> Hi Hugh,<br>
>>><br>
>>> indirectly you give very good advice :) ... try with clean <br>
>>> configuration .<br>
>>><br>
>>> I have relatively complex configuration across multiple files and <br>
>>> some Perl codes, so it is somehow hard to do proper redact. However <br>
>>> it is very easy for me to create simple clean example for test.<br>
>>><br>
>>> I will do that today and send findings and configuration.<br>
>>><br>>>> Dubravko<br>
>>><br>
>>> On 4/8/26 2:01 AM, Hugh Irvine wrote:<br>
>>>><br>
>>>> Hello Dubravko -<br>
>>>><br>
>>>> Could you please send us a redacted copy of the configuration file?<br>
>>>><br>
>>>> I've not seen a connection string like the one you show below?<br>
>>>><br>>>>><br>
>>>> Hugh<br>
>>>><br>
>>>><br>
>>>> On 7/4/2026 23:48, Dubravko Penezic via radiator wrote:<br>
>>>>> Hi,<br>
>>>>><br>
>>>>> few days ago we change from Debian 12 to Debian 13 , and working <br>
>>>>> configuration of RADIATOR 4.30-1 stop working on part that connect <br>
>>>>> to LDAP (OpenLDAP) service on same server.<br>
>>>>><br>
>>>>> Error is as following :<br>
>>>>><br>
>>>>> 00b6e9f0 Tue Apr 7 15:38:58 2026 533634: DEBUG: Handling with <br>
>>>>> Radius::AuthLDAP2:<br>
>>>>> 00000000 Tue Apr 7 15:38:58 2026 533789: INFO: AuthLDAP2 <br>
>>>>> Connecting to ldapi:/// port 389<br>
>>>>> 00000000 Tue Apr 7 15:38:58 2026 534044: ERR: AuthLDAP2 Could not <br>
>>>>> open LDAP connection to ldapi:/// port 389. Backing off for 60 <br>
>>>>> seconds.<br>
>>>>><br>
>>>>> I did check slapd configuration end check ldapi:/// EXTERNAL <br>
>>>>> authentication from command line, and impersonate like radiator <br>
>>>>> user everything work correctly , "only" RADIATOR is not able to <br>
>>>>> connect.<br>
>>>>><br>
>>>>> Any idea ? or debugging options ?<br>
>>>>><br>>>>>><br>
>>>>> Dubravko Penezic<br>
>>>>><br>
>>>>> Srce<br><br></blockquote></div></div>
</div>