Repository navigation
KNOX-3575: Add sizeLimit and timeLimit parameters to LdapBackend.search - #1514
Merged
Merged
Conversation
handavid
force-pushed
the
KNOX-3575-sizelimit
branch
from
November 14, 2026 18:48
1877403 to
038e7d3
Compare
…ch() Thread the per-request size and time limits from the SearchOperationContext through UserSearchInterceptor into the backends. FileBackend respects sizeLimit by truncating results (timeLimit is not applicable to its in-memory lookups). LdapProxyBackend forwards timeLimit to the remote server on each page and enforces sizeLimit client-side, combined with the configured maxResultSetSize (smaller positive bound wins). A backward-compatible default search() overload delegates with no limits. While here, fix FileBackend user matching to use standard LDAP filter semantics: searchUsers now evaluates the parsed filter against each user entry via LdapUtils.matchesFilter instead of an ad-hoc substring check, so wildcard, presence, substring and boolean assertions behave correctly. The backend also exposes the username under sAMAccountName (in addition to uid) so AD-style user searches continue to resolve the same user. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
handavid
force-pushed
the
KNOX-3575-sizelimit
branch
from
November 14, 2026 19:05
038e7d3 to
3f85a84
Compare
Contributor
Author
lmccay
approved these changes
Nov 14, 2026
lmccay
left a comment
lmccay
left a comment
Contributor
There was a problem hiding this comment.
Changes look good to me.
I'll merge once the checks pass.
Test Results 5 files 5 suites 1m 45s ⏱️ Results for commit 3f85a84. |
Contributor
|
@handavid - I have merged this and it will be available in the next release. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KNOX-3757 - LDAP Proxy passes sizelimit to backend
What changes were proposed in this pull request?
Thread the per-request size and time limits from the SearchOperationContext through UserSearchInterceptor into the backends.
FileBackend respects sizeLimit by truncating results (timeLimit is not applicable to its in-memory lookups). LdapProxyBackend forwards timeLimit to the remote server on each page and enforces sizeLimit client-side, combined with the configured maxResultSetSize (smaller positive bound wins).
A backward-compatible default search() overload delegates with no limits.
How was this patch tested?
Ran updated unit tests.
Manually tested through ldapsearch with sizelimit against an Active Directory backend with ~500 users
search w/o sizelimit for comparison
search w/ sizelimit 10 prior to this change
search w/ sizelimit 10 after this change
Integration Tests
No integration tests were updated because this feature is not visible through the integration tests (other than potentially execution time)
UI changes
No UI changes