Bug 42167 - password reset (student) causes search for every user in LDAP before narrowing it down
Summary: password reset (student) causes search for every user in LDAP before narrowin...
Status: CLOSED FIXED
Alias: None
Product: UCS@school
Classification: Unclassified
Component: UMC - Password reset
Version: UCS@school 4.1 R2
Hardware: Other Linux
: P5 major
Target Milestone: UCS@school 4.1 R2 vXXX
Assignee: Sönke Schwardt-Krummrich
QA Contact: Florian Best
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-29 13:07 CEST by Jens Thorp-Hansen
Modified: 2016-10-06 21:29 CEST (History)
6 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?: 4: Will affect most installed domains
How will those affected feel about the bug?: 5: Blocking further progress on the daily work
User Pain: 0.571
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments
Extracted patch as hotfix (NOT TESTED BY QA!) (2.68 KB, patch)
2016-08-30 13:06 CEST, Sönke Schwardt-Krummrich
Details | Diff
patch (53 bytes, patch)
2016-08-30 14:25 CEST, Florian Best
Details | Diff
patch (2.26 KB, patch)
2016-08-30 14:26 CEST, Florian Best
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jens Thorp-Hansen univentionstaff 2016-08-29 13:07:00 CEST
when trying to reset student passwords as a teacher and choosing the right class the UMC takes very long to show the search result of the students in said class. Background: every user in the ldap is searched for name, surname, class, etc. before narrowing this down to the class at hand and displaying the result.

example: school environment with 10 schools, 20 classes each and 5000 students/teachers

teacher tries to reset password of "anton a" in class "12b" of school "gesamtschule 2" - he starts "password reset (students) module" (and has hopefully autosearch off!), chooses the class and waits around 5 minutes till the UMC shows him the 20 results.
Comment 1 Sönke Schwardt-Krummrich univentionstaff 2016-08-29 13:15:32 CEST
(In reply to Jens Thorp-Hansen from comment #0)
> Background: every user in the ldap is searched for name,
> surname, class, etc. before narrowing this down to the class at hand and
> displaying the result.

In this case every student is opened in SchoolBaseModule._users() and afterwards the opened user objects are matched against the given group → all user objects that are not group member are dropped immediately → a lot of useless LDAP requests.
Comment 2 Sönke Schwardt-Krummrich univentionstaff 2016-08-30 11:59:40 CEST
The code has been optimized:
If _users() is called and a group has been specified, only the DNs of the group members are tried to open.
In my test environment this reduces the response time of "query" for the "password (students)" module from ~1700ms down to ~180ms (264 UCS@school users total in LDAP; group contains 26 users; timing is average over 5 measurements).

ucs-school-lib.yaml:
r72015 | Bug #42167: improve inefficient code of SchoolBaseModule._users() to speed up user search if a group has been specified

ucs-school-lib (9.0.22-1):
r72015 | Bug #42167: improve inefficient code of SchoolBaseModule._users() to speed up user search if a group has been specified
Comment 3 Sönke Schwardt-Krummrich univentionstaff 2016-08-30 13:06:07 CEST
Created attachment 7943 [details]
Extracted patch as hotfix (NOT TESTED BY QA!)

patch -d /usr/share/pyshared/ucsschool/lib --backup < bug42167c.patch

The patch has NOT been tested by QA yet!
Comment 4 Florian Best univentionstaff 2016-08-30 14:25:13 CEST
Created attachment 7944 [details]
patch

Even more efficient is to specifiy the pattern as filter instead of evaluating this after opening the object.
Comment 5 Florian Best univentionstaff 2016-08-30 14:26:52 CEST
Created attachment 7945 [details]
patch
Comment 6 Sönke Schwardt-Krummrich univentionstaff 2016-08-31 14:11:06 CEST
* UCSSchoolHelperAbstractClass.get_only_udm_obj() now supports an optional
  search base as argument
* last change was not optimal ==> LDAP search patterns are now evaluated by 
  the LDAP server before opening/retrieving the UDM object
* changes in LDAP_Filter have been reverted

ucs-school-lib (9.0.23-1):
r72125 | Bug #42167: added changelog entry
r72124 | Bug #42167: get UDM objects directly and filter via LDAP search filter
r72123 | Bug #42167: allow to define an optional search base in get_only_udm_obj()
r72122 | Bug #42167: revert changes from last commit in class LDAP_Filter

ucs-school-lib.yaml:
r72126 | Bug #42167: updated advisory

Package: ucs-school-lib
Version: 9.0.23-1.256.201608311408
Comment 7 Florian Best univentionstaff 2016-09-08 15:02:48 CEST
OK: changes
OK: YAML
Comment 8 Sönke Schwardt-Krummrich univentionstaff 2016-10-04 13:24:53 CEST
UCS@school 4.1 R2 v5 has been released.

http://docs.software-univention.de/changelog-ucsschool-4.1R2v5-de.html

If this error occurs again, please clone this bug.