It seems lighttpd mod_auth leaks a ldap connection to the ldap server each time a request is made.
I had this problem loading a page with 600 images protected with ldap auth, lighttpd overloaded my ldap server with too many ldap connections.
I traced the problem and discovered that the ldap anonymous connection (used to find the dn) is opened on each connection in the http_auth_basic_password_compare function (http_auth.c) and is never closed.
It should be opened once and saved in p->conf.ldap but p->conf.ldap is reset to 0 before http_auth_basic_password_compare is called in the mod_auth_patch_connection function at the following line:
PATCH(ldap);
Looking at the code, from what I understand, p->conf.x is usually initialised when mod_auth is loaded, with a pointer to the structure or a string that will contains the data, and the plugin functions modify the data but not the pointer.
But for p->conf.ldap, the pointer is modified by http_auth_basic_password_compare and so it is lost between each call.
Shouldn't the type of p->conf.ldap be (LDAP**) rather that (LDAP*) and initalised when the plugin is loaded ?
Tell me if I am wrong, I didn't propose a patch because I am not sure I really understood the code yet.
