[jira] [Commented] (KNOX-644) Limit/page results of LDAP group membership search

["Kevin Risden (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KNOX-644?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15402055#comment-15402055 ] 

Kevin Risden commented on KNOX-644:
-----------------------------------

Few more thoughts about how to improve, won't get back to this for a few days:
* Should make one query for groups and member instead of one search for groups and then a search for each member in the group
** This would make 1 ldap search instead of n ldap searches - 1 for each group
** This should simplify group lookup quite a bit

> Limit/page results of LDAP group membership search 
> ---------------------------------------------------
>
>                 Key: KNOX-644
>                 URL: https://issues.apache.org/jira/browse/KNOX-644
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 0.6.0
>            Reporter: Kevin Minder
>            Priority: Critical
>             Fix For: 0.10.0
>
>         Attachments: KNOX-644-paging.patch, KNOX-644.patch, ad_setup.ps1, create_groups_ldif.py, paging.patch
>
>
> Some users are finding that they have >1000 groups that would be returned given how Knox currently implements group lookup. ActiveDirectory currently limits search results to 1000 items and this causes failures that require workarounds at the client side.  Ideally Knox's LDAP group search implementation would either limit/filter the results or page the result set that are unavoidably large.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)