add paging to ldap search #22
Conversation
on larger directories, a single-query can exceed the size limit of a single search, giving the errorr (SIZE_EXCEEDED). This commit changes the ldap search to use paging, whereas multiple search requests of a default size of 1000 results are made. This was created with inspiration from the following sources: - https://gist.github.com/mattfahrner/c228ead9c516fc322d3a - https://bitbucket.org/jaraco/python-ldap/src/f208b6338a28/Demo/paged_search_ext_s.py?fileviewer=file-view-default
|
Verified working with three different Active Directories. |
sync_ldap_groups_to_svn_authz.py
Outdated
| @@ -114,7 +114,8 @@ def bind(): | |||
| """This function will bind to the LDAP instance and return an ldapobject.""" | |||
|
|
|||
| ldapobject = ldap.initialize(url) | |||
|
|
|||
| ldapobject.protocol_version = ldap.VERSION3 #paging results only apply to LDAP v3 | |||
There was a problem hiding this comment.
Would it make sense to turn this into a CLI option? If you can manipulate these options as you have without affecting other AD versions or LDAP servers, it wouldn't matter but I'm not sure.
There was a problem hiding this comment.
If you want, sure i can make the ldap protocol version, into a cli option (with 3 being the default)
There was a problem hiding this comment.
LDAP 3 has existed since 1997, and LDAP 2 officially died in 2003. That's a while back... So I assert it's not worth the added complexity to add an LDAP version parameter.
|
So the LDAP version is a CLI option but paging (and its options) aren't. Thoughts? |
|
You have a point that these might be related, and i did add the LDAP version CLI addition, mainly because of your comments. The paging ldap functionality is part of ldap v3, and dates to 1999. Its RFC is here RFC2696. So it would seem quite old. I don't really know the users of this project very well, so I really cannot say whether this change would be a breaking change. Otherwise one would have to look into adding functionality, which would make the script able to detect wether paging is possible, and fall back to the old logic if it isn't. But thats fairly more complex code. |
on larger directories, a single-query can exceed the size limit of a
single search, giving the errorr (SIZE_EXCEEDED).
This commit changes the ldap search to use paging, whereas multiple
search requests of a default size of 1000 results are made.
This was created with inspiration from the following sources: