Alan DeKok wrote:
It's simple. If you put a DNS name into the configuration file, it's resolved to an IP address when the server starts, and cached forever.
I think we are talking of the the server= entries in an ldap config section which are passed to libldap directly and the DNS entries are looked up at runtime from there. For load balancing LDAP here we simply have multiple server= lines all specifying the same DNS name, which has roundrobin entries and this seems to work just fine, especially given the connection pooling. Most of our DNS traffic is windbind finding kerberos SRV records... but then we don't LDAP directly to AD. 100 DNS lookups per second being a problem would seem to indicate the DNS is not well situated close to the authentication server, though.