Is There An OUD Solution To Block Inefficient LDAP Searches

(Doc ID 2216475.1)

Last updated on FEBRUARY 15, 2017

Applies to:

Oracle Unified Directory - Version 11.1.2.3.0 and later
Information in this document applies to any platform.

Goal

The following enquiry is described:

==================================================================================
Scenario Description
++++++++++++++++++
Issue: Need to know if there is a solution in OUD to block inefficient LDAP searches.

Some client code has triggered an ldap search query, with inefficient filter continuously at a regular interval, and the
Search Result execution time was high.

The Client wants to know if there is a way in OUD to block such requests.


Example Output (related to inefficient search execution)
++++++++++++++++++++++++++++++++++++++++++
Detail from OUD access log file pasted below:
----
[16/Nov/2016:00:31:00 -0500] CONNECT conn=3895 from=10.212.28.23:45763 to=10.107.36.13:21389 protocol=LDAP
[16/Nov/2016:00:31:00 -0500] BIND REQ conn=3895 op=0 msgID=4 type=SIMPLE dn="cn=SVC_UPMSService_BGE_NP,ou=service accounts,dc=oracle,dc=com" version=3
[16/Nov/2016:00:31:00 -0500] BIND RES conn=3895 op=0 msgID=4 result=0 authDN="cn=SVC_UPMSService_BGE_NP,ou=service accounts,dc=oracle,dc=com" etime=0
[16/Nov/2016:00:31:00 -0500] SEARCH REQ conn=3895 op=1 msgID=5 base="ou=Users,dc=oracle,dc=com" scope=base filter="(|(objectclass=*)(objectclass=ldapsubentry))" attrs="ALL"
[16/Nov/2016:00:31:00 -0500] SEARCH RES conn=3895 op=1 msgID=5 result=0 nentries=1 etime=0
[16/Nov/2016:00:31:00 -0500] SEARCH REQ conn=3895 op=2 msgID=6 base="ou=Users,dc=oracle,dc=com" scope=sub filter="(&(uid=*)(sn=*)(&(objectclass=exeloncustomer)(objectclass=inetorgperson)))" attrs="uid,mail,givenName,cn,sn,exhintquestion1,exhintquestion2,exhintquestion3,extemporarypwdtimestamp,exprofiletype,exprofilestatus,excustomeridentifier,exlastlockedoutdate,exIsPrimaryProfile,createTimestamp,ds-pwp-account-disabled,pwdAccountLockedTime,pwdFailureTime"
..
[16/Nov/2016:00:45:35 -0500] SEARCH RES conn=3895 op=2 msgID=6 result=0 nentries=527046 additionalInfo="Unindexed" etime=874359

================================================================================
 

Solution

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms