From 3fb0f5333613beabeead3feb73dc0fea9694bcdc Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 19 Aug 2021 16:45:14 -0400 Subject: [PATCH] Increase default limit on LDAP searches to 100k A similar change was attempted years ago in commit 9724251292e4c0797367fcc351a9f16f30c6aefe but it was never applied because it used the wrong DN and because nsslapd-timelimit is already present in the entry the default keyword won't trigger. Use replace instead to increase the value to 100k from the default as originally intended. nsslapd-sizelimit can be changed only with a MOD_REPLACE otherwise a LDAP_NO_SUCH_ATTRIBUTE error is thrown. IPA only uses MOD_REPLACE for single-value attributes but nsslapd-sizelimit is not yet in schema. Add it to the known set of exceptions for single-value attributes. https://pagure.io/freeipa/issue/8962 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- install/updates/10-config.update | 2 +- ipapython/ipaldap.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/install/updates/10-config.update b/install/updates/10-config.update index dec42c025..403476687 100644 --- a/install/updates/10-config.update +++ b/install/updates/10-config.update @@ -16,7 +16,7 @@ only: nsslapd-pluginPrecedence: 60 # Set limits to suite better IPA deployment sizes, defaults are too # conservative dn: cn=config -default: nsslapd-sizelimit:100000 +replace: nsslapd-sizelimit:2000::100000 dn: cn=config,cn=ldbm database,cn=plugins,cn=config replace: nsslapd-lookthroughlimit:5000::100000 diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py index 7d2b06eea..f94b784d6 100644 --- a/ipapython/ipaldap.py +++ b/ipapython/ipaldap.py @@ -763,6 +763,7 @@ class LDAPClient: 'nsslapd-enable-upgrade-hash': True, 'nsslapd-db-locks': True, 'nsslapd-logging-hr-timestamps-enabled': True, + 'nsslapd-sizelimit': True, }) time_limit = -1.0 # unlimited