feat(ldap): Slim user synchronization mechanics - #29
josegomezr wants to merge 4 commits into
Conversation
69a3d7d to
76bb73d
Compare
tacerus
left a comment
tacerus
left a comment
There was a problem hiding this comment.
The search generator is a nice idea, but does it bring any functional benefit over using the existing functions? I am wondering as the changes to the core code are quite large ..
At first removes divergent uses of the ldap library (Base synchronizer implements pagination by hand, but membership paginator uses paged search) so all of them use the same mechanism (generator with paged search). On the other hand, I'm still need to work on extra methods on the base synchronizer, the ldap task decorates a lot of things outside of the synchronizer that are easily computable there. Like the user_filters based on the provider user distinguished name, or extending the base search scope with the user/group filter, etc. What I can do for a more easy change management experience is to isolate the changes to another object and add it to the inheritance chain. There I can overwrite the implementations (and duplicate them potentially) but will make diffs against the upstream file much easier to manage |
9b57001 to
64afb41
Compare
|
Went back and forth a bit more on the JIT sync tasks. TL;DR:
|
778b725 to
a3bf541
Compare
| from authentik.suse.ldap.tasks import ( | ||
| ldap_jit_sync_existing_users, # noqa: F401 | ||
| ldap_trigger_jit_sync, # noqa: F401 | ||
| ldap_trigger_jit_sync_direct, # noqa: F401 | ||
| ) |
There was a problem hiding this comment.
A forced side effect so they're available in dramatiq's task discovery mechanism
|
Not sure if I'm missing something from the last discussion, but I'm still conflicted about the benefit of the large amount of JIT logic, as every user logging in again exponentially increases the amount of users to cover in the full/clenaup sync, leading back to the original issue in the long run. |
the JIT part is for manual operations (to force sync a single user rather than going for a full directory scan), it's available for us via the terminal but not in use in the server hot paths. I can remove The Timestamp+delta handling will follow in a bit, I couldn't retro fit it easily yesterday on #35, I'll bring it here. |
feat(suse,ldap): Group/User/Membership synchronizer classes expose the `since=` parameter. It accepts a datetime and expands the `search_filter` with `(modifyTimestamp>={since})` to narrow down the LDAP results.
feat(suse,ldap): Group/User/Membership synchronizer exposes a `sync_single_record` exposing the logic of processing a single entry.
feat(suse,ldap): Group/User/Membership synchronizer exposes a `get_iterator` method returning an unconditional generator (even if sync is disabled) respecting the base dn restrictions + since
feat(suse,ldap): Align all ldap search operations to use extended search instead of manual cookie fetching
feat(ldap): Disable sync task schedule on save, avoid spamming the LDAP task on changes to the source.
…riants Minimize changes in the upstream files by decorating the python class inheritance chain.
josegomezr
changed the title
Slim sync downloads DN pages into the cache, and each page is live queried in the background. Optimizes cache storage at the expense of increasing LDAP traffic by querying single entries many many many times.
2 participants
No description provided.