1# Id 2# Copyright 1999-2021 The OpenLDAP Foundation, All Rights Reserved. 3# COPYING RESTRICTIONS APPLY, see COPYRIGHT. 4 5# This contribution is derived from OpenLDAP Software. 6# All of the modifications to OpenLDAP Software represented in this contribution 7# were developed by Andrew Findlay <andrew.findlay@skills-1st.co.uk>. 8# I have not assigned rights and/or interest in this work to any party. 9# 10# Copyright 2008 Andrew Findlay 11# Redistribution and use in source and binary forms, with or without 12# modification, are permitted only as authorized by the OpenLDAP Public License. 13 14H1: Limits 15 16H2: Introduction 17 18It is usually desirable to limit the server resources that can be 19consumed by each LDAP client. OpenLDAP provides two sets of limits: 20a size limit, which can restrict the {{number}} of entries that a 21client can retrieve in a single operation, and a time limit 22which restricts the length of time that an operation may continue. 23Both types of limit can be given different values depending on who 24initiated the operation. 25 26H2: Soft and Hard limits 27 28The server administrator can specify both {{soft limits}} and 29{{hard limits}}. Soft limits can be thought of as being the 30default limit value. Hard limits cannot be exceeded by ordinary 31LDAP users. 32 33LDAP clients can specify their own 34size and time limits when issuing search operations. 35This feature has been present since the earliest version of X.500. 36 37If the client specifies a limit then the lower of the requested value 38and the {{hard limit}} will become the limit for the operation. 39 40If the client does not specify a limit then the server applies the 41{{soft limit}}. 42 43Soft and Hard limits are often referred to together as {{administrative 44limits}}. Thus, if an LDAP client requests a search that would return 45more results than the limits allow it will get an {{adminLimitExceeded}} 46error. Note that the server will usually return some results even if 47the limit has been exceeded: this feature is useful to clients that 48just want to check for the existence of some entries without needing 49to see them all. 50 51The {{rootdn}} is not subject to any limits. 52 53H2: Global Limits 54 55Limits specified in the global part of the server configuration act 56as defaults which are used if no database has more specific limits set. 57 58In a {{slapd.conf}}(5) configuration the keywords are {{EX:sizelimit}} and 59{{EX:timelimit}}. When using the {{slapd config}} backend, the corresponding 60attributes are {{EX:olcSizeLimit}} and {{EX:olcTimeLimit}}. The syntax of 61these values are the same in both cases. 62 63The simple form sets both soft and hard limits to the same value: 64 65> sizelimit {<integer>|unlimited} 66> timelimit {<integer>|unlimited} 67 68The default sizelimit is 500 entries and the default timelimit is 693600 seconds. 70 71An extended form allows soft and hard limits to be set separately: 72 73> sizelimit size[.{soft|hard}]=<integer> [...] 74> timelimit time[.{soft|hard}]=<integer> [...] 75 76Thus, to set a soft sizelimit of 10 entries and a hard limit of 75 entries: 77 78E: sizelimit size.soft=10 size.hard=75 79 80H3: Special Size Limits 81 82There are other forms of size limits in addition to the soft and hard limits. 83Note that when using the simple {{sizelimit}} form, none of these special 84limits are changed. 85 86H4: Unchecked Limits 87 88The {{unchecked}} keyword sets a limit on how many entries the server 89will examine after doing index lookups but before evaluating filter 90matches. If the set of candidates exceeds this limit, the search is aborted. 91The purpose is to avoid causing excessive workload on {{slapd}} 92if a filter uses attributes that are not properly indexed, and can 93be critical for very large directories. 94 95> sizelimit size.unchecked={<integer>|unlimited|disabled} 96 97The default is unlimited. The {{disabled}} setting prevents a search 98from being performed at all. This may be useful in the per-database 99limits described below, to disallow searches for a specific set of users. 100 101H4: Paged Results Limits 102 103If the LDAP client adds the {{pagedResultsControl}} to the search operation, 104the hard size limit is used by default, because the request for a specific 105page size is considered an explicit request for a limitation on the number 106of entries to be returned. However, the size limit applies to the total 107count of entries returned within the search, and not to a single page. 108 109Additional size limits may be enforced for paged searches. 110 111The {{EX:size.pr}} limit controls the maximum page size: 112 113> sizelimit size.pr={<integer>|noEstimate|unlimited} 114 115{{EX:<integer>}} is the maximum page size if no explicit size is set. 116{{EX:noEstimate}} has no effect in the current implementation as the 117server does not return an estimate of the result size anyway. 118{{EX:unlimited}} indicates that no limit is applied to the maximum 119page size. 120 121The {{EX:size.prtotal}} limit controls the total number of entries 122that can be returned by a paged search. By default the limit is the 123same as the normal {{EX:size.hard}} limit. 124 125> size.prtotal={<integer>|unlimited|disabled} 126 127{{EX:unlimited}} removes the limit on the number of entries that can be 128returned by a paged search. 129{{EX:disabled}} can be used to selectively disable paged result searches. 130 131H2: Per-Database Limits 132 133Each database can have its own set of limits that override the global 134ones. The syntax is more flexible, and it allows different limits to 135be applied to different entities. Note that an {{entity}} is different from 136an {{entry}}: the term {{entity}} is used here to indicate the ID of the 137person or process that has initiated the LDAP operation. 138 139In a {{slapd.conf}}(5) configuration the keyword is {{EX:limits}}. 140When using the {{slapd config}} backend, the corresponding 141attribute is {{EX:olcLimits}}. The syntax of 142the values is the same in both cases. 143 144> limits <selector> <limit> [<limit> [...]] 145 146The {{limits}} clause can be specified multiple times to apply different 147limits to different initiators. The server examines each clause in turn 148until it finds one that matches the operation's initiator or base DN. 149If no match is found, the global limits will be used. 150 151H3: Specify who the limits apply to 152 153The {{EX:<selector>}} part of the {{limits}} clause can take any of these values: 154 155!block table; align=Center; coltags="EX,N"; \ 156 title="Table 9.1: Limits Entity Specifiers" 157Specifier|Entities 158*|All, including anonymous and authenticated users 159anonymous|Anonymous (non-authenticated) users 160users|Authenticated users 161dn[.<type>][.<style>]=<pattern>]|Entry or entries within a scope that match <pattern> 162group[/oc[/at]]=<pattern>|Members of a group 163!endblock 164 165Where 166 167{{type}} can be one of self or this and 168 169{{style}} can be one of exact, base, onelevel, subtree, children, regex, or anonymous 170 171More information can be found in the {{slapd.conf}}(5) or {{slapd-config}}(5) manual 172pages. 173 174H3: Specify time limits 175 176The syntax for time limits is 177 178E: time[.{soft|hard}]=<integer> 179 180where integer is the number of seconds slapd will spend 181answering a search request. 182 183If neither {{soft}} nor {{hard}} is specified, the value is used for both, 184e.g.: 185 186E: limits anonymous time=27 187 188The value {{unlimited}} may be used to remove the hard time limit entirely, 189e.g.: 190 191E: limits dn.exact="cn=anyuser,dc=example,dc=org" time.hard=unlimited 192 193H3: Specifying size limits 194 195The syntax for size limit is 196 197E: size[.{soft|hard}]=<integer> 198 199where {{EX:<integer>}} is the maximum number of entries slapd will return 200when answering a search request. 201 202In addition to soft and hard limits, other limits are also available, 203with the same meanings described for the global limits configuration above. 204 205 206H2: Example Limit Configurations 207 208H3: Simple Global Limits 209 210This simple global configuration fragment applies size and time limits 211to all searches by all users except {{rootdn}}. It limits searches to 21250 results and sets an overall time limit of 10 seconds. 213 214E: sizelimit 50 215E: timelimit 10 216 217H3: Global Hard and Soft Limits 218 219It is sometimes useful to limit the size of result sets but to allow 220clients to request a higher limit where needed. This can be achieved 221by setting separate hard and soft limits. 222 223E: sizelimit size.soft=5 size.hard=100 224 225To prevent clients from doing very inefficient non-indexed searches, 226add the {{unchecked}} limit: 227 228E: sizelimit size.soft=5 size.hard=100 size.unchecked=100 229 230H3: Giving specific users larger limits 231 232Having set appropriate default limits in the global configuration, 233you may want to give certain users the ability to retrieve larger 234result sets. Here is a way to do that in the per-database configuration: 235 236E: limits dn.exact="cn=anyuser,dc=example,dc=org" size=100000 237E: limits dn.exact="cn=personnel,dc=example,dc=org" size=100000 238E: limits dn.exact="cn=dirsync,dc=example,dc=org" size=100000 239 240It is generally best to avoid mentioning specific users in the server 241configuration. A better way is to give the higher limits to a group: 242 243E: limits group/groupOfNames/member="cn=bigwigs,dc=example,dc=org" size=100000 244 245H3: Limiting who can do paged searches 246 247It may be required that certain applications need very large result sets that 248they retrieve using paged searches, but that you do not want ordinary 249LDAP users to use the pagedResults control. The {{pr}} and {{prtotal}} 250limits can help: 251 252E: limits group/groupOfNames/member="cn=dirsync,dc=example,dc=org" size.prtotal=unlimited 253E: limits users size.soft=5 size.hard=100 size.prtotal=disabled 254E: limits anonymous size.soft=2 size.hard=5 size.prtotal=disabled 255 256H2: Glued/Subordinate database configurations 257When using subordinate databases, it is necessary for any limits that 258are to be applied across the parent and its subordinates to be defined in both 259the parent and its subordinates. Otherwise the settings on the subordinate databases 260are not honored. 261 262H2: Further Information 263 264For further information please see {{slapd.conf}}(5), {{ldapsearch}}(1) and {{slapd.access}}(5) 265 266