On 07/03/2024 18:01, Mike Mercier wrote:
Has anyone else experienced this? Is there a knob I have to tune somewhere that I am unaware of? It partly depends on how you are resolving group membership.
Firstly, upgrade to version 3.2.3 (from https://packages.networkradius.com) Prior to that version there was a hard coded limit on the number of groups which would be cached. In version 3.2.3, that limit only applies if the caching involves doing a group name -> DN resolution (i.e. the LDAP server returns names and you've asked for DNs to be cached). For the most efficient group checks, it is worth verifying how the LDAP server returns groups and use that form. I.e. if the server returns names, then set cacheable_name = 'yes' and do all your checks using group names. If the server returns DNs then set cacheable_dn = 'yes' and do all your checks using DNs. This significantly reduces the number of LDAP queries that are run. Nick -- Nick Porter