Multiple TACACS+/RADIUS servers enhancement

[Disco402]

Expected Behaviour

Be able to define multiple TACACS/RADIUS servers for failover, servers should be listed as per the LDAP server list and tried in that order. If the server is not available move onto the next in the list.

Documentation for RADIUS only describes the "server" option
https://github.com/netdisco/netdisco/wiki/Configuration#radius

Documentation for LDAP describes the "servers" option
https://github.com/netdisco/netdisco/wiki/Configuration#ldap

Current Behaviour

Currently TACACS/RADIUS options can only use one server which breaks authentication if that server is not available

Possible Solution

Might be possible to reuse the "servers" code from LDAP option but I am unsure if that is a good idea.

Context

Allows for HA of the authentication mechanism when using TACACS/RADIUS auth

[ollyg]

We use https://metacpan.org/pod/Authen::Radius which supports only a single server, as far as I can tell

However https://metacpan.org/pod/Authen::TacacsPlus seems to support multiple servers.

[ollyg]

Oh, looks like the RADIUS module can do it too:

Optional parameter NodeList may contain a Perl reference to an array, containing a list of Radius Cluster nodes. Each nodes in the list can be specified using a hostname or IP (with an optional port number), i.e. 'radius1.mytel.com' or 'radius.myhost.com:1812'. Radius Cluster contains a set of Radius servers, at any given moment of time only one server is considered to be "active" (so requests are send to this server). How the active node is determined? Initially in addition to the NodeList parameter you may supply the Host parameter and specify which server should become the first active node. If this parameter is absent, or the current active node does not reply anymore, the process of "discovery" will be performed: a request will be sent to all nodes and the consecutive communication continues with the node, which will be the first to reply.

[ollyg]

thanks for the suggestion, implemented in
[master 31fc6e1] #734 Multiple TACACS+/RADIUS servers now supported

(docs will be updated to reflect the new way of config)

[Disco402]

Works great, had to lower the timeout value (15) otherwise it takes awhile but otherwise great. Cheers!