Adam Bultman writes:

No, it doesn't. Each authdaemon will open exactly one LDAP connection, that will remain open as long as authdaemon is running, or until there's 1-2 minutes of inactivity. There may be a temporary second connection, if you use authenticated binds, but there will never be more than two persistent LDAP connections from a single authdaemon processes.

55 connections is required for, maybe, Yahoo or AOL. For you, it's overkill, and the default of five authdaemon processes should be sufficient.

Assuming a very generous 100 milliseconds per LDAP lookup, a single authdaemon process will handle ten lookups per second. Five of them will handle fifty a second, three hundred a minute, and 18,000 per hour.

So, unless all of your 22K users logs on more often than once an hour, five connections will be more than enough.

More than likely your load balancer is broken, and must be fixed. My guess is that it assumes that LDAP connections are short term connections. And they are, with most simple-minded LDAP clients, that bind, query, and disconnect. Authdaemon is more efficient than that. It opens a connection and holds it open, avoiding the utterly useless waste of time for connecting and disconnecting from the LDAP server, for each authentication time.

Each authdaemon is probably connecting to your LDAP server, through your load balancer, with the first authentication attempt. After the response is received, the load balancer assumes that the connection is no longer needed, and drops it from its memory, but as far as the authdaemon and LDAP server is concerned, it's still a valid connection.

With the next connection attempt, authdaemon gets a broken socket indication, since the load balancer has dropped the first connection from memory, and automatically reconnects to the LDAP server, that still thinks the first connection exists.

It won't take long before everything comes crashing down.