[pbs-devel] [PATCH proxmox 2/2] ldap: only search base of base_dn when checking connection

[Stefan Sterz]

this should avoid most common size limitations. the search should also
complete quicker as fewer results need to be computed. note that this
way a configuration may be accepted, but the related sync job can
fail due to and exceeded size limit warning for some ldap servers
(such as 2.5.14+dfsg-0ubuntu0.22.04.2).

Signed-off-by: Stefan Sterz <s.sterz at proxmox.com>
---
spend way to much time figuring this out, anyway, wanted to add some
notes here that i encountered while testing potential solutions:

* when using an anonymous bind with slapd in its default configuration
  the default size limit will also be enforced against a paged
  search. this means that while a configuration may succeed with 5
  users with an anonymous bind, it will fail with 500+ users.
* if the client specifies a size limit for the search and the server
  finds more results than specified by the search limit it will
  return only the specified amount of results. however, the result
  code will still be 4 (sizeLimitExceeded) resulting in an error. the
  same happens if the server specifies a limit and the search exceeds
  it. it also uses the the result code 4 (sizeLimitExceeded) in that
  case.
* if a streaming_search is finished before all results are retrieved,
  ldap3 will handle this as specified in the relevant rfc from what i
  can tell [1]. however, the result code will then be 88 for a user
  canceled request, which is treated as an `Err` Result in ldap3.

[1]: https://datatracker.ietf.org/doc/html/rfc2696

 proxmox-ldap/src/lib.rs | 34 +++++++++++++---------------------
 1 file changed, 13 insertions(+), 21 deletions(-)

diff --git a/proxmox-ldap/src/lib.rs b/proxmox-ldap/src/lib.rs
index c47870d..b3b5d65 100644
--- a/proxmox-ldap/src/lib.rs
+++ b/proxmox-ldap/src/lib.rs
@@ -177,30 +177,22 @@ impl Connection {
                 .await?
                 .success()
                 .context("LDAP bind failed, bind_dn or password could be incorrect")?;
+        }
 
-            let (_, _) = ldap
-                .search(
-                    &self.config.base_dn,
-                    Scope::Subtree,
-                    "(objectClass=*)",
-                    vec!["*"],
-                )
-                .await?
-                .success()
-                .context("Could not search LDAP realm, base_dn could be incorrect")?;
+        // only search base to make sure the base_dn exists while avoiding most common size limits
+        let (_, _) = ldap
+            .search(
+                &self.config.base_dn,
+                Scope::Base,
+                "(objectClass=*)",
+                vec!["*"],
+            )
+            .await?
+            .success()
+            .context("Could not search LDAP realm, base_dn could be incorrect")?;
 
+        if self.config.bind_dn.is_some() {
             let _: Result<(), _> = ldap.unbind().await; // ignore errors, search succeeded already
-        } else {
-            let (_, _) = ldap
-                .search(
-                    &self.config.base_dn,
-                    Scope::Subtree,
-                    "(objectClass=*)",
-                    vec!["*"],
-                )
-                .await?
-                .success()
-                .context("Could not search LDAP realm, base_dn could be incorrect")?;
         }
 
         Ok(())
-- 
2.39.2