[handavid]

KNOX-3533 - Skip group membership resolution in LdapProxyBackend when memberOf is not requested

What changes were proposed in this pull request?

Pass the client's requested attributes from UserSearchInterceptor to LdapBackend.search() so LdapProxyBackend only resolves group memberships when memberOf (or *) is requested.

How was this patch tested?

Unit tests were updated for the new functionality.

Manual search queries were run against the LDAP proxy to compare the results and time. Proxy was configured with recursive member resolution and the default depth of 3

    <property>
        <name>gateway.ldap.recursive.group.resolution</name>
        <value>true</value>
    </property>

The LdapProxyBackend was exercised with with useMemberOf configured both on and off

results with useMemberOf on:

# query w/ memberOf attribute
time ldapsearch -v -x -H ldap://localhost:3890  -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password  -E pr=250/noprompt  -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass memberof
...
# numResponses: 494
# numEntries: 492
ldapsearch -v -x -H ldap://localhost:3890 -D  -w bind-password -E  -b  -s sub  0.01s user 0.02s system 0% cpu 7.007 total

# query w/o memberOf attribute
time ldapsearch -v -x -H ldap://localhost:3890  -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password  -E pr=250/noprompt  -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass
...
# numResponses: 494
# numEntries: 492
ldapsearch -v -x -H ldap://localhost:3890 -D  -w bind-password -E  -b  -s sub  0.01s user 0.01s system 1% cpu 1.718 total

Since memberOf is enabled, this optimization saves time by skipping the recursive member resolution

results with useMemberOf off:

# query w/ memberOf attribute
time ldapsearch -v -x -H ldap://localhost:3890  -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password  -E pr=250/noprompt  -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass memberof
...
# numResponses: 494
# numEntries: 492
ldapsearch -v -x -H ldap://localhost:3890 -D  -w bind-password -E  -b  -s sub  0.01s user 0.02s system 0% cpu 1:05.76 total

# query w/o memberOf attribute
time ldapsearch -v -x -H ldap://localhost:3890  -D 'uid=BIND2,ou=people,dc=proxy,dc=com' -w bind-password  -E pr=250/noprompt  -b 'ou=people,DC=proxy,DC=com' -s sub '(uid=*)' uid objectclass
...
# numResponses: 494
# numEntries: 492
ldapsearch -v -x -H ldap://localhost:3890 -D  -w bind-password -E  -b  -s sub  0.01s user 0.02s system 1% cpu 2.324 total

When useMemberOf is not enabled, group membership is found using searches per user. This leads to a large fan-out of searches if the number of users is large.

Integration Tests

Integration tests were run, but no new integration tests were added because there should be no change in the results retrieved through the LDAP Proxy.

UI changes

No UI changes

[handavid]

@hanicz @pzampino

[github-actions]

Test Results

  5 files    5 suites   1m 30s ⏱️
198 tests 196 ✅ 2 💤 0 ❌
239 runs  237 ✅ 2 💤 0 ❌

Results for commit ba3431b.

♻️ This comment has been updated with latest results.

[smolnar82]

Only a nitpick comment that should be fixed in the JavaDoc IMO.