Hi all, FR 3.1.0 git#64aa7f9 I've been doing some testing around HA and servers looking at multiple ldap sources. For the most part everything is fine and dandy, but when the ldap search can't be made (e.g. one of the round robin dns entries goes off line), the connection timeout doesn't seem to behave. I've tried setting the connect_timeout ldap option, and also the NETWORK_TIMEOUT option in /etc/ldap/ldap.conf, but to no avail; connection timeouts take at least a minute or more. Using ldapsearch does seem to honour the latter perfectly. It's difficult to show the behaviour in a debug readout, since Are there any known issues with FR or the ldap library version that would cause this? Am I missing something!? Config: rlm_ldap (ldap_sath): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap_sath): Couldn't find configuration for post-auth, will return NOOP for calls from this section rlm_ldap (ldap_sath): Initialising connection pool pool { start = 0 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 20 connect_timeout = 3.000000 retry_delay = 1 spread = no FR output: Tue May 10 17:46:39 2016 : Info: rlm_ldap (ldap_sath): Opening additional connection (2), 1 of 10 pending slots used Tue May 10 17:46:39 2016 : Debug: rlm_ldap (ldap_sath): Connecting to ldaps://sath.nhs.uk:636 Tue May 10 17:46:39 2016 : Debug: rlm_ldap (ldap_sath): New libldap handle 0x2a2ea10 Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Waiting for bind result... Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Bind successful Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Reserved connection (2) Tue May 10 17:48:46 2016 : Debug: (3) Performing search in "dc=SATH,dc=nhs,dc=uk" with filter "sAMAccountName=989096b80618", scope "sub" Tue May 10 17:48:46 2016 : Debug: (3) Waiting for search result... Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Released connection (2) Tue May 10 17:48:46 2016 : Info: rlm_ldap (ldap_sath): Need 3 more connections to reach 3 spares Tue May 10 17:48:46 2016 : Info: rlm_ldap (ldap_sath): Opening additional connection (3), 1 of 9 pending slots used Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Connecting to ldaps://sath.nhs.uk:636 Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): New libldap handle 0x2aa2d00 Ldapsearch (it's set to 6 seconds here, but 3 in FR, I was seeing which took precendence. Not setting the ldap.conf, i.e. commenting out gives same result btw). time ldapsearch -x -H ldaps://10.128.176.1 -D "ldapquery" -b "OU=Phones,OU=MAC Addresses,OU=Trust owned,OU=Wired 802.1x MAC,OU=SATHNetwork,DC=SATH,DC=nhs,DC=uk" -s sub "(cn=*)" cn mail sn dn -w <hidden> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) real 0m6.009s user 0m0.000s sys 0m0.000s Thanks Andy