The new openldap servers have tighter limits on unindexed searches. That results in:
$ ldaplist -l passwd
The search returned an error.
If there's a compelling reason to keep those limits low then I can live with this, but there are a fair number of useful workflows that begin with 'list all users, grep for X' which are no somewhat uglier.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Invalid | None | T122595 Restore ldaplist -l passwd | |||
| Restricted Task | |||||
| Restricted Task |
I have a patch for that which is working fine, but there's been an API change in python-ldap 2.3 (precise) and 2.4 (trusty, jessie). Do we also need this in precise?`Then I would need to implement some alternate fallback in the old API.
Ok, I'll simply not use the server control for paged searches when using python-ldap < 2.4, then.
My old patch from https://gerrit.wikimedia.org/r/#/c/262745/ was wrong, it still needs more work to actually request the followup pages,
Change 295177 had a related patch set uploaded (by Tim Landscheidt):
WIP: ldap: Make ldaplist use paging for queries
My WIP patch works in principle, and I'll add the Precise compatibility, but:
It will fail for ldaplist passwd because there are getent passwd | wc -l = 3525 entries for users, but size_limit (I assume) is set to the default 2048, so it can never retrieve all users.
Can size_limit be increased to 4096 (or more)?
Change 295198 had a related patch set uploaded (by Muehlenhoff):
Bump the size limit for labs openldap server to 4096
I've created https://gerrit.wikimedia.org/r/#/c/295198/ to raise the size limit. The reason my patch and our patch are not effective is because OpenLDAP handles paged search requests differently from Active Directory (for which all of those docs are usually written since AD applies a fairly tiny size limit by default (1000): OpenLDAP applies the size limit to the sum of all paged requests, while AD applies them per page. So the only real fix is to raise the limit.
Change 295177 abandoned by Tim Landscheidt:
WIP: ldap: Make ldaplist use paging for queries
Reason:
Cf. I198d39.
Change 295198 abandoned by Muehlenhoff:
Bump the size limit for labs openldap server to 4096
Closing as invalid which probably isn't technically correct, but paged searches certainly work.