Setting Resource Limits

This chapter shows you how to set resource limits that prevent directory clients from using an unfair share of system resources. In this chapter you will learn to:

  • Limit the resources used when a user searches the directory

  • Limit how long connections can remain idle before they are dropped

  • Limit the connections a client can hold before it authenticates

  • Limit the size of directory server requests

Limiting Search Resources

Well-written directory client applications limit the scope of their searches with filters that narrow the number of results returned. By default, OpenDJ only allows users with appropriate privileges to perform unindexed searches. You can further adjust additional limits on search operations, such as the following:

  • The lookthrough limit defines the maximum number of candidate entries OpenDJ considers when processing a search.

    The default lookthrough limit, which is set by using the global server property lookthrough-limit, is 5000.

    You can override the limit for a particular user by changing the operational attribute, ds-rlim-lookthrough-limit, on the user’s entry.

  • The size limit sets the maximum number of entries returned for a search.

    The default size limit, which is set by using the global server property size-limit, is 1000.

    You can override the limit for a particular user by changing the operational attribute, ds-rlim-size-limit, on the user’s entry.

  • The time limit defines the maximum processing time OpenDJ devotes to a search operation.

    The default time limit, which is set by using the global server property time-limit, is 1 minute.

    You can override the limit for a particular user by changing the operational attribute, ds-rlim-time-limit, on the user’s entry. Times for ds-rlim-time-limit are expressed in seconds.

  • The idle time limit defines how long OpenDJ allows idle connections to remain open.

    The default idle time limit, which is set by using the global server property idle-time-limit, is 600 seconds. Servers set up with earlier versions keep the explicit 0 seconds, no limit at all, they were set up with; a server with no value, for example after dsconfig set-global-configuration-prop --reset idle-time-limit, gets the new default.

    You can override the limit for a particular user by changing the operational attribute, ds-rlim-idle-time-limit, on the user’s entry. Times for ds-rlim-idle-time-limit are expressed in seconds.

  • The maximum number of persistent searches can be set by using the global server property max-psearches.

To Set Search Limits For a User

  • Change the user entry to set the limits to override:

    $ cat limit.ldif
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
add: ds-rlim-size-limit
ds-rlim-size-limit: 10

$ ldapmodify \
 --port 1389 \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --filename limit.ldif
Processing MODIFY request for uid=bjensen,ou=People,dc=example,dc=com
MODIFY operation successful for DN uid=bjensen,ou=People,dc=example,dc=com

    Now when Babs Jensen performs a search returning more than 10 entries, she sees the following message:

    Result Code:  4 (Size Limit Exceeded)
Additional Information:  This search operation has sent the maximum of
 10 entries to the client
To Set Search Limits For a Group

  1. Create an LDAP subentry to specify the limits using collective attributes:

    $ cat grouplim.ldif
dn: cn=Remove Administrator Search Limits,dc=example,dc=com
objectClass: collectiveAttributeSubentry
objectClass: extensibleObject
objectClass: subentry
objectClass: top
cn: Remove Administrator Search Limits
ds-rlim-lookthrough-limit;collective: 0
ds-rlim-size-limit;collective: 0
ds-rlim-time-limit;collective: 0
subtreeSpecification: {base "ou=people", specificationFilter "
 (isMemberOf=cn=Directory Administrators,ou=Groups,dc=example,dc=com)" }

$ ldapmodify \
 --port 1389 \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --defaultAdd \
 --filename grouplim.ldif
Processing ADD request for
 cn=Remove Administrator Search Limits,dc=example,dc=com
ADD operation successful for DN
 cn=Remove Administrator Search Limits,dc=example,dc=com

  2. Check the results:

    $ ldapsearch --port 1389 --baseDN dc=example,dc=com uid=kvaughan +|grep ds-rlim
ds-rlim-lookthrough-limit: 0
ds-rlim-time-limit: 0
ds-rlim-size-limit: 0

Limiting Idle Time

If you have applications that leave connections open for long periods, OpenDJ can end up devoting resources to maintaining connections that are no longer used. If your network does not drop such connections eventually, OpenDJ drops them once they have been idle for the time set by the global configuration property, idle-time-limit. By default, the limit is 600 seconds; a value of 0 seconds sets no limit. Servers set up with earlier versions have no limit until you set one.

If your network load balancer is configured to drop connections that have been idle for some time, make sure you set the OpenDJ idle time limit to a lower value than the idle time limit for the load balancer. This helps to ensure that idle connections are shut down in orderly fashion. Setting the OpenDJ limit lower than the load balancer limit is particularly useful with load balancers that drop idle connections without cleanly closing the connection and notifying the client and server.

OpenDJ does not enforce idle timeout for persistent searches:

 
$ dsconfig \
 set-global-configuration-prop \
 --port 4444 \
 --hostname opendj.example.com \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --set idle-time-limit:24h \
 --trustAll \
 --no-prompt

The example shown sets the idle time limit to 24 hours.

Limiting Connections Before Authentication

A client does not need to authenticate to open a connection, so a client that opens connections and never uses them can take the connections, and the file descriptors, that other clients need. The following settings bound what such a client can hold:

  • The global server property max-allowed-client-connections limits the number of concurrent client connections. By default, the limit is 4096; a value of 0 sets no limit. Connections to the administration connector count toward the limit but are never rejected by it, so that you can still connect to change the configuration once the other connections reach the limit. Servers set up with earlier versions keep the explicit 0 they were set up with; a server with no value, for example after dsconfig set-global-configuration-prop --reset max-allowed-client-connections, gets the new default.

  • The LDAP connection handler property first-request-time-limit sets how long a new connection may stay open before a complete request arrives on it. By default, a connection on which no complete request arrives within 60 seconds is closed; a value of 0 seconds sets no limit. Once the first request has arrived, idle-time-limit applies.

  • The LDAP connection handler property max-client-connections-per-address limits the number of connections that a single client IP address can hold through the connection handler, so that one client cannot take all the connections allowed by max-allowed-client-connections. By default, the limit is 1024; a value of 0 sets no limit. The limit only protects the other clients while it stays below max-allowed-client-connections: a limit at or above it never applies, because the server-wide limit rejects the connection first. Clients behind a load balancer or a network address translation device share its address, so set the limit above the number of connections they need together.

The following example limits each client address to 256 connections through the LDAP connection handler:

$ dsconfig \
 set-connection-handler-prop \
 --port 4444 \
 --hostname opendj.example.com \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --handler-name "LDAP Connection Handler" \
 --set max-client-connections-per-address:256 \
 --trustAll \
 --no-prompt

Limiting Maximum Request Size

The default maximum request size of 5 MB, set using the advanced connection handler property max-request-size, is sufficient to satisfy most client requests. Yet, there are some cases where you might need to raise the request size limit. For example, if clients add groups with large numbers of members, those add requests can go beyond the 5 MB limit:

$ dsconfig \
 set-connection-handler-prop \
 --port 4444 \
 --hostname opendj.example.com \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --handler-name "LDAP Connection Handler" \
 --set max-request-size:20mb \
 --trustAll \
 --no-prompt

The example shown sets the maximum request size on the LDAP connection handler to 20 MB.

Resource Limits and Proxied Authorization

Proxied authorization uses a standard LDAP control to permit an application to bind as one user and then carry out LDAP operations on behalf of other users.

When using proxied authorization as described in "Configuring Proxied Authorization" in the Directory Server Developer’s Guide know that the resource limits do not change when the user proxies as another user. In other words, resource limits depend on the bind DN, not the proxy authorization identity.