In large LDAP directories, the fetching of entire member lists has proven to take a significant amount of time.

Specifically, this problem was encountered in the following situation:

• An LDAP directory had hundreds of thousands of users
• There were hundreds of groups attached to a single user
• Some of those groups (<10) had member counts in the hundreds of thousands

In this environment, fetching the groups for a particular user took upwards of one minute. This was tested directly by executing the corresponding ldapsearch query (&(member=cn=Username,ou=People,o=Organization)(objectClass=groupOfNames))

Adjusting the query to include distinguishedName (e.g. (&(member=cn=Username,ou=People,o=Organization)(objectClass=groupOfNames)) distinguishedName) changed the return time of the query from one minute to under one second.

It is theorized that the sheer size of the objects being returned - and corresponding stress on the LDAP server to fetch such a query - was responsible for the delays.

What is the fix?

• The fix currently in test for this issue removes the "member" attribute from the search queries done for a group. This avoids pulling all the members of a group.

• It was found that when we pull details of a group, we do not need its list of members in most cases. Only case where we need to find a groups members is when nested group memberships are enabled on the auth config, since we then need to look at all sub-groups of this group.

What to test?

• We need to test and validate that all the functionalities related to OpenLDAP, FreeIPA and AD(less impacted) are unaffected.
• Especially testcases around cluster/project memberships granted to groups should let the group members correct access
• Also need to make sure that testcases around nested groups are working fine.
• Also should validate with large dataset - with users having say 1000 groups and few groups having 1000 members.

Rancher version: v2.4-head (04/06/2020) 04159d0 up to v2.4-head (04/08/2020) 64cf5ec

Completed P1 scenarios test coverage and manual RBAC tests.

• OpenLDAP
• FreeIPA
• ActiveDirectory

Tested with Rancher master-head build ( f47eb1a)
P1 scenarios and manual RBAC tests passed for the below Auth providers:

• OpenLDAP
• FreeIPA
• ActiveDirectory

SURE-3019