handavid opened a new pull request, #1475: URL: https://github.com/apache/knox/pull/1475
[KNOX-3533](https://issues.apache.org/jira/browse/KNOX-3533) - Skip group membership resolution in LdapProxyBackend when memberOf is not requested ## What changes were proposed in this pull request? Pass the client's requested attributes from UserSearchInterceptor to LdapBackend.search() so LdapProxyBackend only resolves group memberships when memberOf (or *) is requested. ## How was this patch tested? Unit tests were updated for the new functionality. Manual search queries were run against the LDAP proxy to compare the results and time. Proxy was configured with recursive member resolution and the default depth of 3 ``` <property> <name>gateway.ldap.recursive.group.resolution</name> <value>true</value> </property> ``` The LdapProxyBackend was exercised with with useMemberOf configured both on and off results with useMemberOf on: ``` # query w/ memberOf attribute time ldapsearch -v -x -H ldap://localhost:3890 -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password -E pr=250/noprompt -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass memberof ... # numResponses: 494 # numEntries: 492 ldapsearch -v -x -H ldap://localhost:3890 -D -w bind-password -E -b -s sub 0.01s user 0.02s system 0% cpu 7.007 total # query w/o memberOf attribute time ldapsearch -v -x -H ldap://localhost:3890 -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password -E pr=250/noprompt -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass ... # numResponses: 494 # numEntries: 492 ldapsearch -v -x -H ldap://localhost:3890 -D -w bind-password -E -b -s sub 0.01s user 0.01s system 1% cpu 1.718 total ``` Since memberOf is enabled, this optimization saves time by skipping the recursive member resolution results with useMemberOf off: ``` # query w/ memberOf attribute time ldapsearch -v -x -H ldap://localhost:3890 -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password -E pr=250/noprompt -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass memberof ... # numResponses: 494 # numEntries: 492 ldapsearch -v -x -H ldap://localhost:3890 -D -w bind-password -E -b -s sub 0.01s user 0.02s system 0% cpu 1:05.76 total # query w/o memberOf attribute time ldapsearch -v -x -H ldap://localhost:3890 -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password -E pr=250/noprompt -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass ... # numResponses: 494 # numEntries: 492 ldapsearch -v -x -H ldap://localhost:3890 -D -w bind-password -E -b -s sub 0.01s user 0.02s system 1% cpu 2.324 total ``` When useMemberOf is not enabled, group membership is found using searches per user. This leads to a large fan-out of searches if the number of users is large. ## Integration Tests Integration tests were run, but no new integration tests were added because there should be no change in the results retrieved through the LDAP Proxy. ## UI changes No UI changes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
