You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "handavid (via GitHub)" <gi...@apache.org> on 2026/07/29 05:24:53 UTC
[PR] Knox-3386: LDAP Proxy pages backends [knox]
handavid opened a new pull request, #1331:
URL: https://github.com/apache/knox/pull/1331
[KNOX-3386](https://issues.apache.org/jira/browse/KNOX-3386) - LDAP Proxy pages backends
## What changes were proposed in this pull request?
Adds a gateway.ldap.max.size.limit and max.time.limit configs to the LDAP Proxy. Thes configs are uses to set the LDAP server's maxSizeLimit and maxTimeLimit fields. The size limit indictes the maximum total number of search results for a request across all pages. The time limit is in milliseconds.
Implements paging to the backend LDAP servers. This is controlled by a new "pageSize" config on the LDAP Proxy Backends.
A bug was found during testing where the getUserGroups method will doubly retrieve the groups. This has been fixed.
## How was this patch tested?
(Please explain how this patch was tested. For instance: running automated unit/integration tests, manual tests. Please write down your test steps as detailed as possible)
Unit tests were added/updated in LdapProxyBackendTest and LdapProxyBackendSslTest
manual testing was performed against AD by setting the following values in the gateway-site.xml
```
<property>
<name>gateway.ldap.sizelimit</name>
<value>5000</value>
<description>Base DN for LDAP entries in the proxy server. Default is dc=proxy,dc=com.</description>
</property>
<property>
<name>gateway.ldap.interceptor.localldap.pageSize</name>
<value>3</value>
</property>
<property>
<name>gateway.ldap.interceptor.ad.pageSize</name>
<value>3</value>
</property>
```
Logging was increased to DEBUG level to see the paging-related log messages.
## Integration Tests
(Please add or update integration tests [`.github/workflows/tests`](.github/workflows/tests) for the feature you are adding. If no unit test is added, please explain why. Check out [`.github/workflows/tests/README.md`](./workflows/tests/README.md) for instructions)
The gateway-site was modified for the workflow tests to set a small page size. This ensure that the proxy needs to page to return the results in the tests.
## UI changes
none
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 merged PR #1331:
URL: https://github.com/apache/knox/pull/1331
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "handavid (via GitHub)" <gi...@apache.org>.
handavid commented on code in PR #1331:
URL: https://github.com/apache/knox/pull/1331#discussion_r3690330961
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -73,6 +73,10 @@ public interface LdapMessages {
text = "Creating LDAP interceptor: {0} (via {1})")
void ldapInterceptorCreating(String interceptorName, String source);
+ @Message(level = MessageLevel.INFO,
+ text = "Configuring LDAP interceptor {0}: {1} = {2})")
Review Comment:
fixed
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -73,6 +73,10 @@ public interface LdapMessages {
text = "Creating LDAP interceptor: {0} (via {1})")
void ldapInterceptorCreating(String interceptorName, String source);
+ @Message(level = MessageLevel.INFO,
+ text = "Configuring LDAP interceptor {0}: {1} = {2})")
+ void ldapInterceptorConfiguring(String interceptorNamee, String configName, String configValue);
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "handavid (via GitHub)" <gi...@apache.org>.
handavid commented on PR #1331:
URL: https://github.com/apache/knox/pull/1331#issuecomment-5138702602
@smolnar82 ready for re-review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 commented on code in PR #1331:
URL: https://github.com/apache/knox/pull/1331#discussion_r3686909146
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java:
##########
@@ -511,12 +521,10 @@ public List<Entry> searchUsers(String filter, SchemaManager schemaManager) throw
try {
connection = getConnection();
String ldapFilter = "(" + remoteUserIdentifierAttribute + "=" + filter.trim() + ")";
- try (EntryCursor cursor = connection.search(remoteUserSearchBase, ldapFilter, SearchScope.SUBTREE, "*")) {
- while (cursor.next()) {
- Entry sourceEntry = cursor.get();
- addGroupMemberships(sourceEntry, connection, entryCache, resolvedParentsCache);
- results.add(remoteSchemaConverter.convertRemoteEntryToProxyEntry(sourceEntry, schemaManager));
- }
+ List<Entry> searchResults = performPagedSearch(connection, remoteUserSearchBase, ldapFilter, SearchScope.SUBTREE, "*");
Review Comment:
Previously `searchUsers` had no `try/catch` around its cursor, so an `LdapException` propagated to the caller. Now it routes through `performPagedSearch`, which catches and logs, returning partial/empty results. So a backend failure during user search now looks like "no users found" rather than an error. `search()` already behaved this way, so this may be intentional. But it's a behavior change for `searchUsers`. Please confirm silent degradation is desired there (auth/lookup failures being indistinguishable from empty results can be a real operational issue).
##########
gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java:
##########
@@ -809,4 +874,28 @@ public Set<String> get(Object key) {
// For the second user, many groups should have been found in the cache.
assertEquals("Expected " + expectedCacheHits + " cache hits for shared groups, but got " + cacheHits.get(), expectedCacheHits, cacheHits.get());
}
+
+ private static class CapturingSearchRequestHandler extends LdapRequestHandler<SearchRequest> {
+ private final LdapRequestHandler<SearchRequest> delegate;
+ private final List<SearchRequest> requests = Collections.synchronizedList(new ArrayList<>());
+
+ CapturingSearchRequestHandler(LdapRequestHandler<SearchRequest> delegate) {
+ this.delegate = delegate;
+ }
+
+ public void reset() {
+ requests.clear();
+ }
+
+ public List<SearchRequest> getRequests() {
+ return List.copyOf(requests);
+ }
+
+ @Override
+ public void handle(LdapSession session, SearchRequest message) throws Exception {
+ requests.add(message);
+ System.out.println(message.toString());
Review Comment:
nit: this should be removed.
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java:
##########
@@ -839,15 +841,67 @@ private List<Entry> getUserGroupsInternal(LdapConnection connection, Dn... dns)
String filter = buildMultipleGroupMemberFilter(dns);
- try (EntryCursor cursor = connection.search(remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn")) {
- while (cursor.next()) {
- groups.add(cursor.get());
- }
- }
+ groups.addAll(performPagedSearch(connection, remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn"));
return groups;
}
+ protected List<Entry> performPagedSearch(LdapConnection connection, String baseDn, String filter, SearchScope scope, String... attributes ) throws LdapException, CursorException, IOException {
+ List<Entry> results = new ArrayList<>();
+
+ // 1. Setup basic search parameters
+ SearchRequest searchRequest = new SearchRequestImpl();
+ searchRequest.setBase(new Dn(baseDn));
+ searchRequest.setFilter(filter);
+ searchRequest.setScope(scope);
+ searchRequest.addAttributes(attributes);
+
+ // 2. Initialize the PagedResults control
+ PagedResults pagedControl = new PagedResultsImpl();
+ pagedControl.setSize(pageSize);
+ searchRequest.addControl(pagedControl);
+
+ byte[] cookie = null;
+
+ // 3. Loop until no more pages remain
+ int pageNumber = 1;
+ do {
+ // Update cookie for the subsequent pages
+ if (cookie != null) {
+ pagedControl.setCookie(cookie);
+ }
+
+ try (SearchCursor cursor = connection.search(searchRequest)) {
+ LOG.ldapPagedSearch(baseDn, filter, pageSize, pageNumber);
+ while (cursor.next()) {
+ Response response = cursor.get();
+
+ // Process matching entries
+ if (response instanceof SearchResultEntry) {
+ Entry entry = ((SearchResultEntry) response).getEntry();
+ results.add(entry);
+ }
+ }
+ if (cursor.isDone()) {
+ SearchResultDone done = cursor.getSearchResultDone();
+ PagedResults responseControl = (PagedResults) done.getControl(PagedResults.OID);
+
+ if (responseControl != null) {
+ cookie = responseControl.getCookie();
+ } else {
+ cookie = null;
+ }
+ }
+ pageNumber++;
+ } catch (LdapException e) {
+ LOG.ldapSearchFailed(baseDn, filter, e);
Review Comment:
Here we log the failure but do not clear cookie or break the loop. As a result, it might end up in an infinite loop: `page 1` succeeds and returns a non-empty cookie. So the loop continues; `page 2`'s `connection.search(...)` (or cursor iteration) throws `LdapException` (server restart, timeout, connection drop mid-paging). The exception is caught, `cookie` still holds page 1's value, `pageNumber++` is skipped, and the loop condition is still `true`. It retries the identical failing page forever.
The old code (`search(...)`) caught `LdapException` around a single cursor and simply stopped with partial results. To preserve that, the catch should terminate the loop, e.g.:
```
} catch (LdapException e) {
LOG.ldapSearchFailed(baseDn, filter, e);
break; // or: cookie = null;
}
```
What do you think?
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -133,9 +141,9 @@ public interface LdapMessages {
text = "Backend user not found: {0}")
void ldapUserNull(String username);
- @Message(level = MessageLevel.ERROR,
+ @Message(level = MessageLevel.DEBUG,
text = "Failed to copy attribute: {0}")
- void ldapAttributeCopyError(@StackTrace(level = MessageLevel.DEBUG) Exception e);
+ void ldapAttributeCopyError(@StackTrace(level = MessageLevel.TRACE) Exception e);
Review Comment:
Why are these changes needed here? Shouldn't this remain on `ERROR` level instead of `DEBUG`? We might hide real conversion problems.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Knox-3386: LDAP Proxy pages backends [knox]
Posted by "handavid (via GitHub)" <gi...@apache.org>.
handavid commented on PR #1331:
URL: https://github.com/apache/knox/pull/1331#issuecomment-5113611135
@smolnar82
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 commented on code in PR #1331:
URL: https://github.com/apache/knox/pull/1331#discussion_r3688241540
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -133,9 +141,9 @@ public interface LdapMessages {
text = "Backend user not found: {0}")
void ldapUserNull(String username);
- @Message(level = MessageLevel.ERROR,
+ @Message(level = MessageLevel.DEBUG,
text = "Failed to copy attribute: {0}")
- void ldapAttributeCopyError(@StackTrace(level = MessageLevel.DEBUG) Exception e);
+ void ldapAttributeCopyError(@StackTrace(level = MessageLevel.TRACE) Exception e);
Review Comment:
Makes sense, thanks for the detailed explanation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "handavid (via GitHub)" <gi...@apache.org>.
handavid commented on code in PR #1331:
URL: https://github.com/apache/knox/pull/1331#discussion_r3687377781
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java:
##########
@@ -839,15 +841,67 @@ private List<Entry> getUserGroupsInternal(LdapConnection connection, Dn... dns)
String filter = buildMultipleGroupMemberFilter(dns);
- try (EntryCursor cursor = connection.search(remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn")) {
- while (cursor.next()) {
- groups.add(cursor.get());
- }
- }
+ groups.addAll(performPagedSearch(connection, remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn"));
return groups;
}
+ protected List<Entry> performPagedSearch(LdapConnection connection, String baseDn, String filter, SearchScope scope, String... attributes ) throws LdapException, CursorException, IOException {
+ List<Entry> results = new ArrayList<>();
+
+ // 1. Setup basic search parameters
+ SearchRequest searchRequest = new SearchRequestImpl();
+ searchRequest.setBase(new Dn(baseDn));
+ searchRequest.setFilter(filter);
+ searchRequest.setScope(scope);
+ searchRequest.addAttributes(attributes);
+
+ // 2. Initialize the PagedResults control
+ PagedResults pagedControl = new PagedResultsImpl();
+ pagedControl.setSize(pageSize);
+ searchRequest.addControl(pagedControl);
+
+ byte[] cookie = null;
+
+ // 3. Loop until no more pages remain
+ int pageNumber = 1;
+ do {
+ // Update cookie for the subsequent pages
+ if (cookie != null) {
+ pagedControl.setCookie(cookie);
+ }
+
+ try (SearchCursor cursor = connection.search(searchRequest)) {
+ LOG.ldapPagedSearch(baseDn, filter, pageSize, pageNumber);
+ while (cursor.next()) {
+ Response response = cursor.get();
+
+ // Process matching entries
+ if (response instanceof SearchResultEntry) {
+ Entry entry = ((SearchResultEntry) response).getEntry();
+ results.add(entry);
+ }
+ }
+ if (cursor.isDone()) {
+ SearchResultDone done = cursor.getSearchResultDone();
+ PagedResults responseControl = (PagedResults) done.getControl(PagedResults.OID);
+
+ if (responseControl != null) {
+ cookie = responseControl.getCookie();
+ } else {
+ cookie = null;
+ }
+ }
+ pageNumber++;
+ } catch (LdapException e) {
+ LOG.ldapSearchFailed(baseDn, filter, e);
Review Comment:
I removed the catch to let the calling methods handle or propagate the exception. This breaks the loop.
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -133,9 +141,9 @@ public interface LdapMessages {
text = "Backend user not found: {0}")
void ldapUserNull(String username);
- @Message(level = MessageLevel.ERROR,
+ @Message(level = MessageLevel.DEBUG,
text = "Failed to copy attribute: {0}")
- void ldapAttributeCopyError(@StackTrace(level = MessageLevel.DEBUG) Exception e);
+ void ldapAttributeCopyError(@StackTrace(level = MessageLevel.TRACE) Exception e);
Review Comment:
we get these messages because the entry returned from the backend holds attributes that are not in the proxy's schema. This isn't an "error", but rather an artifact of the design. At error level, the logs get flooded with 10s of lines per entry, which would make the log unusable.
##########
gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java:
##########
@@ -809,4 +874,28 @@ public Set<String> get(Object key) {
// For the second user, many groups should have been found in the cache.
assertEquals("Expected " + expectedCacheHits + " cache hits for shared groups, but got " + cacheHits.get(), expectedCacheHits, cacheHits.get());
}
+
+ private static class CapturingSearchRequestHandler extends LdapRequestHandler<SearchRequest> {
+ private final LdapRequestHandler<SearchRequest> delegate;
+ private final List<SearchRequest> requests = Collections.synchronizedList(new ArrayList<>());
+
+ CapturingSearchRequestHandler(LdapRequestHandler<SearchRequest> delegate) {
+ this.delegate = delegate;
+ }
+
+ public void reset() {
+ requests.clear();
+ }
+
+ public List<SearchRequest> getRequests() {
+ return List.copyOf(requests);
+ }
+
+ @Override
+ public void handle(LdapSession session, SearchRequest message) throws Exception {
+ requests.add(message);
+ System.out.println(message.toString());
Review Comment:
done
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java:
##########
@@ -511,12 +521,10 @@ public List<Entry> searchUsers(String filter, SchemaManager schemaManager) throw
try {
connection = getConnection();
String ldapFilter = "(" + remoteUserIdentifierAttribute + "=" + filter.trim() + ")";
- try (EntryCursor cursor = connection.search(remoteUserSearchBase, ldapFilter, SearchScope.SUBTREE, "*")) {
- while (cursor.next()) {
- Entry sourceEntry = cursor.get();
- addGroupMemberships(sourceEntry, connection, entryCache, resolvedParentsCache);
- results.add(remoteSchemaConverter.convertRemoteEntryToProxyEntry(sourceEntry, schemaManager));
- }
+ List<Entry> searchResults = performPagedSearch(connection, remoteUserSearchBase, ldapFilter, SearchScope.SUBTREE, "*");
Review Comment:
good catch. I think that I'll have search propagate the exception also. I don't think it makes sense to return empty if there is an exception in all cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1331:
URL: https://github.com/apache/knox/pull/1331#issuecomment-5117424186
## Test Results
40 tests 40 ✅ 6s ⏱️
3 suites 0 💤
3 files 0 ❌
Results for commit 192151fa.
[test-results]:data:application/gzip;base64,H4sIADTraWoC/12MSw7CMAwFr1JlzaIhTepyGeSGRLJoG5TPCnF33AL9sLJnnjRP4WlwSVwqdapEKpRXuJWImcLEaBh5yPPU1D+4pmLtn7nTg80mPNJwEC7GEL8mlmktzv8h+BFbb+FdbuF9zYZxpMwgZHeWWnp0reoRAbytoVeNAiOt5+tAd7o1IF5vnWCQev8AAAA=
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 commented on code in PR #1331:
URL: https://github.com/apache/knox/pull/1331#discussion_r3688270263
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -73,6 +73,10 @@ public interface LdapMessages {
text = "Creating LDAP interceptor: {0} (via {1})")
void ldapInterceptorCreating(String interceptorName, String source);
+ @Message(level = MessageLevel.INFO,
+ text = "Configuring LDAP interceptor {0}: {1} = {2})")
+ void ldapInterceptorConfiguring(String interceptorNamee, String configName, String configValue);
Review Comment:
nit: typo in the parameter name `interceptorNamee`
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java:
##########
@@ -73,6 +73,10 @@ public interface LdapMessages {
text = "Creating LDAP interceptor: {0} (via {1})")
void ldapInterceptorCreating(String interceptorName, String source);
+ @Message(level = MessageLevel.INFO,
+ text = "Configuring LDAP interceptor {0}: {1} = {2})")
Review Comment:
See the additional `)` at the ned of the message. Please remove it.
##########
knox-site/docs/service_ldap_server.md:
##########
@@ -198,6 +200,10 @@ The proxy backend delegates lookups to a remote LDAP or Active Directory server.
| `gateway.ldap.interceptor.<name>.groupMemberAttribute` | `memberUid` | Attribute used for group membership (e.g., `member` for AD). |
| `gateway.ldap.interceptor.<name>.useMemberOf` | `false` | If `true`, use the `memberOf` attribute for efficient group lookups. |
| `gateway.ldap.interceptor.<name>.proxy.poolMaxActive` | `8` | Maximum number of active connections in the pool. |
+| `gateway.ldap.interceptor.<name>.pageSize` | `1000` | Page size for search requests. |
+| `gateway.ldap.interceptor.<name>.maxResultSetSize` | `0` | Maximum number of results to return from a search, regardless of paging. 0 means unlimited. |
+
+NOTE: If this value is undefined and the interceptor was created by the KnoxLDAPServerManager, the KnoxLDAPServerManager will set the `gateway.ldap.interceptor.<name>.maxResultSetSize` value to be 1 greater than the proxy's `gateway.ldap.roles.max.time.limit` configuration. This will ensure that the proxy returns a "Size limit exceeded" result if the backend has more results than the proxy's limit.
Review Comment:
I think you meant `be 1 greater than the proxy's gateway.ldap.max.size.limit configuration`.
See `time` vs `size` and we don't need the `roles` prefix either (see my comment above).
##########
knox-site/docs/service_ldap_server.md:
##########
@@ -44,6 +44,8 @@ The service is configured in `gateway-site.xml`.
| `gateway.ldap.roles.lookup.strategy` | N/A | The LDAP roles lookup strategy (`file` or `rest`). |
| `gateway.ldap.roles.lookup.rest.api.endpoint` | N/A | The LDAP roles lookup REST API endpoint. |
| `gateway.ldap.roles.lookup.file.path` | N/A | The LDAP roles lookup file path. |
+| `gateway.ldap.roles.max.size.limit` | 1000 | The maximum size limit of the result set returned by search requests. |
+| `gateway.ldap.roles.max.time.limit` | 60000 | The maximum time limit for search requests in milliseconds. |
Review Comment:
Should be `gateway.ldap.max.size.limit` / `gateway.ldap.max.time.limit`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3386: LDAP Proxy pages backends [knox]
Posted by "handavid (via GitHub)" <gi...@apache.org>.
handavid commented on code in PR #1331:
URL: https://github.com/apache/knox/pull/1331#discussion_r3690330130
##########
knox-site/docs/service_ldap_server.md:
##########
@@ -44,6 +44,8 @@ The service is configured in `gateway-site.xml`.
| `gateway.ldap.roles.lookup.strategy` | N/A | The LDAP roles lookup strategy (`file` or `rest`). |
| `gateway.ldap.roles.lookup.rest.api.endpoint` | N/A | The LDAP roles lookup REST API endpoint. |
| `gateway.ldap.roles.lookup.file.path` | N/A | The LDAP roles lookup file path. |
+| `gateway.ldap.roles.max.size.limit` | 1000 | The maximum size limit of the result set returned by search requests. |
+| `gateway.ldap.roles.max.time.limit` | 60000 | The maximum time limit for search requests in milliseconds. |
Review Comment:
fixed
##########
knox-site/docs/service_ldap_server.md:
##########
@@ -198,6 +200,10 @@ The proxy backend delegates lookups to a remote LDAP or Active Directory server.
| `gateway.ldap.interceptor.<name>.groupMemberAttribute` | `memberUid` | Attribute used for group membership (e.g., `member` for AD). |
| `gateway.ldap.interceptor.<name>.useMemberOf` | `false` | If `true`, use the `memberOf` attribute for efficient group lookups. |
| `gateway.ldap.interceptor.<name>.proxy.poolMaxActive` | `8` | Maximum number of active connections in the pool. |
+| `gateway.ldap.interceptor.<name>.pageSize` | `1000` | Page size for search requests. |
+| `gateway.ldap.interceptor.<name>.maxResultSetSize` | `0` | Maximum number of results to return from a search, regardless of paging. 0 means unlimited. |
+
+NOTE: If this value is undefined and the interceptor was created by the KnoxLDAPServerManager, the KnoxLDAPServerManager will set the `gateway.ldap.interceptor.<name>.maxResultSetSize` value to be 1 greater than the proxy's `gateway.ldap.roles.max.time.limit` configuration. This will ensure that the proxy returns a "Size limit exceeded" result if the backend has more results than the proxy's limit.
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org