-
Notifications
You must be signed in to change notification settings - Fork 44
Description
For multiple RADIUS server configured I am aware radsecproxy handles RADIUS authentication responses based on the status of the connection. If one server fails it will fall back to the next server in the realm configuration .
But when it receives an Access-Reject from first server, it considers that response to be definitive for the user and does not retry with other servers.
Currently, as per my observation radsecproxy does not attempt to try additional servers in the realm when it receives an Access-Reject response from a RADIUS server. The request is considered a failure as soon as any server returns an Access-Reject, and radsecproxy does not attempt to authenticate the user using the remaining servers in the realm.
will radsecproxy automatically try the next server ? is this support currently available ?
For Example, I have userA in radius-server-1 and userB in radius-server-2. If i login from my client as userB it should first check in radius-server-1 if the request gets rejected , it should check in radius-server-2. If user is present in either one of these servers Access-Accept should be returned else Access-Reject should be returned. Is this supported in today's radsecproxy? If so, what is the configuration? Am I missing something here?"
...
...
...
server radius-server-1 {
type tls
...
}
server radius-server-2 {
type tls
...
}
realm * {
server radius-server-1
server radius-server-2
}
...
...
...