janiussyafiq commented on PR #13762: URL: https://github.com/apache/apisix/pull/13762#issuecomment-5175782605
> Two issues need to be addressed before this can merge: > > 1. **[P2] Avoid three LDAP operations on every request** > > The successful `rewrite` path currently performs a service-account/anonymous bind, a user search, and a user bind (`0 -> 3` LDAP protocol operations per request). Connection pooling does not remove these round trips. > > Please add a small local TTL cache for successful authentication results. Cache hits should reuse the resolved canonical `user_dn` and skip LDAP entirely; only cache misses should run the full bind -> search -> bind flow. The cache key must include the relevant plugin configuration and a non-reversible credential discriminator—do not key only by username or retain plaintext passwords—and the TTL must be short and bounded. > Will be addressed in upcoming PR slice. > 2. **[P1] Add a gateway lifecycle shell regression** > > This PR adds `ldap-auth-advanced` to the default plugin registry, but the current coverage is limited to Perl `.t` tests. Please add a required-CI `t/cli/test_*.sh` regression that starts the real gateway, exercises plugin loading/configuration with bounded readiness polling, verifies externally observable behavior and plugin state, covers the reverse transition where applicable, and cleans up all processes and temporary configuration. Pushbacked, no existing auth cli tests being exercised. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
