From: Stefan Sterz <s.sterz@proxmox.com>
To: pbs-devel@lists.proxmox.com
Subject: [pbs-devel] [PATCH proxmox 2/2] ldap: only search base of base_dn when checking connection
Date: Fri, 21 Jul 2023 16:34:03 +0200 [thread overview]
Message-ID: <20230721143403.1288116-2-s.sterz@proxmox.com> (raw)
In-Reply-To: <20230721143403.1288116-1-s.sterz@proxmox.com>
this should avoid most common size limitations. the search should also
complete quicker as fewer results need to be computed. note that this
way a configuration may be accepted, but the related sync job can
fail due to and exceeded size limit warning for some ldap servers
(such as 2.5.14+dfsg-0ubuntu0.22.04.2).
Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
---
spend way to much time figuring this out, anyway, wanted to add some
notes here that i encountered while testing potential solutions:
* when using an anonymous bind with slapd in its default configuration
the default size limit will also be enforced against a paged
search. this means that while a configuration may succeed with 5
users with an anonymous bind, it will fail with 500+ users.
* if the client specifies a size limit for the search and the server
finds more results than specified by the search limit it will
return only the specified amount of results. however, the result
code will still be 4 (sizeLimitExceeded) resulting in an error. the
same happens if the server specifies a limit and the search exceeds
it. it also uses the the result code 4 (sizeLimitExceeded) in that
case.
* if a streaming_search is finished before all results are retrieved,
ldap3 will handle this as specified in the relevant rfc from what i
can tell [1]. however, the result code will then be 88 for a user
canceled request, which is treated as an `Err` Result in ldap3.
[1]: https://datatracker.ietf.org/doc/html/rfc2696
proxmox-ldap/src/lib.rs | 34 +++++++++++++---------------------
1 file changed, 13 insertions(+), 21 deletions(-)
diff --git a/proxmox-ldap/src/lib.rs b/proxmox-ldap/src/lib.rs
index c47870d..b3b5d65 100644
--- a/proxmox-ldap/src/lib.rs
+++ b/proxmox-ldap/src/lib.rs
@@ -177,30 +177,22 @@ impl Connection {
.await?
.success()
.context("LDAP bind failed, bind_dn or password could be incorrect")?;
+ }
- let (_, _) = ldap
- .search(
- &self.config.base_dn,
- Scope::Subtree,
- "(objectClass=*)",
- vec!["*"],
- )
- .await?
- .success()
- .context("Could not search LDAP realm, base_dn could be incorrect")?;
+ // only search base to make sure the base_dn exists while avoiding most common size limits
+ let (_, _) = ldap
+ .search(
+ &self.config.base_dn,
+ Scope::Base,
+ "(objectClass=*)",
+ vec!["*"],
+ )
+ .await?
+ .success()
+ .context("Could not search LDAP realm, base_dn could be incorrect")?;
+ if self.config.bind_dn.is_some() {
let _: Result<(), _> = ldap.unbind().await; // ignore errors, search succeeded already
- } else {
- let (_, _) = ldap
- .search(
- &self.config.base_dn,
- Scope::Subtree,
- "(objectClass=*)",
- vec!["*"],
- )
- .await?
- .success()
- .context("Could not search LDAP realm, base_dn could be incorrect")?;
}
Ok(())
--
2.39.2
next prev parent reply other threads:[~2023-07-21 14:34 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-21 14:34 [pbs-devel] [PATCH proxmox 1/2] ldap: add an integration test for `check_connection` Stefan Sterz
2023-07-21 14:34 ` Stefan Sterz [this message]
2023-07-25 8:56 ` [pbs-devel] [PATCH proxmox 2/2] ldap: only search base of base_dn when checking connection Lukas Wagner
2023-08-08 12:03 ` [pbs-devel] applied: " Wolfgang Bumiller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230721143403.1288116-2-s.sterz@proxmox.com \
--to=s.sterz@proxmox.com \
--cc=pbs-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox