Re: slow AD ldap query or bad filter/algorithm?

--001a114b104475578705269f5dd1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

2015-12-11 12:54 GMT+01:00 Natxo Asenjo <[email protected]>:

> hi,
>
> On Fri, Dec 11, 2015 at 12:15 PM, Cl=C3=A9ment OUDOT <[email protected]=
m>
> wrote:
>
>> You should do a search directly on the member DN (with scope base)
>> instead of requestind the suffix in sub _get_ad_user_mail :
>>
>> sub _get_ad_user_mail {
>>     my ($ad_user) =3D @_;
>>     my $search_ad =3D $ad_ldap->search(
>>         base  =3D> $ad_user,
>>         scope =3D> "base",
>>         filter =3D> "(objectclass=3D*)",
>>         attr =3D> ['mail'],
>>     );
>>
>>     $search_ad->code && die "error on search ad: $@: " .
>> $search_ad->error;
>>     for my $entry ( $search_ad->entries ) {
>>         my $ad_user_mail =3D $entry->get_value('mail');
>>         return $ad_user_mail;
>>     }
>> }
>>
>>
> mmm, not very much difference, I'm afraid. Now it's even a bit slower:
> 2m45sec. Could be network bound (behind a vpn connection now).
>
> Maybe I need to get a list of users and save its info in another hash,
> that could be much faster than making lots of queries per group.
>


Another solution is to search users with a filter on memberOf  attribute:
(memberOf=3D<DN of Group>), then you get directly all users entries that
belong to the group.

Cl=C3=A9ment.

--001a114b104475578705269f5dd1
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">2015-12-11 12:54 GMT+01:00 Natxo Asenjo <span dir=3D"ltr">&lt;<a href=
=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
</a>&gt;</span>:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0=
 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">hi,<br>=
<div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote"><span class=
=3D"">On Fri, Dec 11, 2015 at 12:15 PM, Cl=C3=A9ment OUDOT <span dir=3D"ltr=
">&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">clem.oudot@=
gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=
=3D"ltr">You should do a search directly on the member DN (with scope base)=
 instead of requestind the suffix in sub  _get_ad_user_mail :<br><div class=
=3D"gmail_extra"><div class=3D"gmail_quote"><div><span><br>sub _get_ad_user=
_mail {<br>=C2=A0=C2=A0=C2=A0 my ($ad_user) =3D @_;<br>=C2=A0=C2=A0=C2=A0 m=
y $search_ad =3D $ad_ldap-&gt;search(<br></span>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 base=C2=A0 =3D&gt; $ad_user,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 scope =3D&gt; &quot;base&quot;,<br>=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 filter =3D&gt; &quot;(objectclass=3D*)&quot;,<span><br>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 attr =3D&gt; [&#39;mail&#39;],<b=
r>=C2=A0=C2=A0=C2=A0 );<br><br>=C2=A0=C2=A0=C2=A0 $search_ad-&gt;code &amp;=
&amp; die &quot;error on search ad: $@: &quot; . $search_ad-&gt;error;<br>=
=C2=A0=C2=A0=C2=A0 for my $entry ( $search_ad-&gt;entries ) {<br>=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 my $ad_user_mail =3D $entry-&gt;get_value=
(&#39;mail&#39;);<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return $ad_=
user_mail;<br>=C2=A0=C2=A0=C2=A0 }<br>}<br></span></div><br></div></div></d=
iv></blockquote><div><br></div></span><div>mmm, not very much difference, I=
&#39;m afraid. Now it&#39;s even a bit slower: 2m45sec. Could be network bo=
und (behind a vpn connection now). <br></div></div><br></div><div class=3D"=
gmail_extra">Maybe I need to get a list of users and save its info in anoth=
er hash, that could be much faster than making lots of queries per group.<s=
pan class=3D"HOEnZb"><font color=3D"#888888"><br></font></span></div></div>=
</div></blockquote><div><br><br></div><div>Another solution is to search us=
ers with a filter on memberOf=C2=A0 attribute: (memberOf=3D&lt;DN of Group&=
gt;), then you get directly all users entries that belong to the group.<br>=
<br></div><div>Cl=C3=A9ment.<br></div></div></div></div>

--001a114b104475578705269f5dd1--