I am sure this question has been asked many times over, so please point me to a thread if it's already answered. We are connected to an AD-backed LDAP service. I've configured these two options in the ldap module config: Chase_referrals=yes Rebind=yes LDAP authentication is fine for about 10 minutes. After a while, freeradius LDAP authentication begins failing: rad_recv: Access-Request packet from host 10.144.15.2 port 52361, id=92, length=98 User-Name = "redacted-user" User-Password = "redacted-password" NAS-Port-Id = "ssh" Calling-Station-Id = "redacted-fqdn" Service-Type = NAS-Prompt-User NAS-Port = 0 NAS-IP-Address = 10.144.15.2 # Executing section authorize from file /etc/freeradius/radiusd.conf +group authorize { ++[preprocess] = ok [ldap] performing user authorization for redacted-user [ldap] expand: (SamAccountName=%u) -> (SamAccountName=redacted-user) [ldap] expand: dc=redacted,dc=redacted,dc=com -> dc=redacted,dc=redacted,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] closing existing LDAP connection [ldap] (re)connect to ldaps://redacted-ldaps-server-url, authentication 0 [ldap] setting TLS Require Cert to never [ldap] bind as _binduser/bindpassword to ldaps://redacted-ldaps-server-url [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=redacted,dc=Redacted,dc=com, with filter (SamAccountName=redacted-user) WARNING: Please set 'chase_referrals=yes' and 'rebind=yes' WARNING: See the ldap module configuration for details [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = fail +} # group authorize = fail Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 92 to 10.144.15.2 port 52361 Waking up in 4.9 seconds. Cleaning up request 4 ID 92 with timestamp +2501 Ready to process requests. It works fine for a while - what causes it to fail after a while? Does having a loadbalancer in front of the LDAP server make a difference? Thanks! [https://cdn.f5.com/webcommon/email-signature/images/f5-logo-rgb-30x30.jpg]<https://f5.com/> Thomas King | Sr Lab Network Engineer D +1-303-305-0228 M +1-206-384-0698 [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-twitter.jpg]<https://twitter.com/F5Networks/> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-linkedin.jpg]<https://www.linkedin.com/companies/f5-networks> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-facebook.jpg]<https://www.facebook.com/f5networksinc> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-youtube.jpg]<https://www.youtube.com/f5networksinc> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-devcentral.jpg]<https://devcentral.f5.com/> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-wmag-lockup.jpg]<https://f5.com/we-make-apps-go?utm_source=WMAGSIG/>