如何提高用户层次结构的 LDAP 搜索过滤器的性能

Question

I want to search the Reporting hierarchy of a given CN and by using Manager attributes, in a downward direction in LDAP. Can anyone help us to know if there is any performant way of achieving this with the LDAP Search filters in Java? I tried searching different posts but couldn't find an answer.

Ex:
-Dept Head(input CN) - -Level 3 User
--Manager 1 -Level 2 User
---Member 1 -Level 1 User
---Member 2 -Level 1 User
--Manager 2 -Level 2 User
---Member 3 -Level 1 User
---Member 4 -Level 1 User
--Manager 3 -Level 2 User
---Member 5 -Level 1 User
---Member 6 -Level 1 User

In the above example Level 3 Users CN would be input and we should retrieve all the users below him till Level 0(all level Managers and Members) of the given CN.

IF input CN is Level 1 users CN

• Output will include all Level 0 reports below Level 1 User(input CN)

IF input CN is Level 2 users CN

• Output will include all Level 1 and Level 2 reports below Level 1 User(input CN) ... and so on

Right now I am generating a filter for each level dynamically and searching using that filter in the below level. If there are more levels, the search is taking time to return the expected results.

My Code

protected static ArrayList<ValueCollection> getUserReportsTreeDetails(String accountName, String initial,
            String url, String principal, String credentials, String searchFeilds, String resultFeildNames,
            String managerAttribute) throws Exception {
        InitialLdapContext adminContext = null;

        try {
            ArrayList<SearchResult> result = new ArrayList<SearchResult>();
            Properties connectionProperties = new Properties();
            connectionProperties.put("java.naming.factory.initial", initial);
            connectionProperties.put("java.naming.provider.url", url);
            connectionProperties.put("java.naming.referral", "ignore");
            connectionProperties.put("java.naming.security.principal", principal);
            connectionProperties.put("java.naming.security.credentials", credentials);
            connectionProperties.put("javax.security.sasl.maxbuffer", 2000000);

            adminContext = new InitialLdapContext(connectionProperties, null);

            String filter;
            filter = "(&(userstatus=active)(|(" + managerAttribute + "=" + accountName + ")(CN=" + accountName + ")))";
            String searchFeildsArray[] = searchFeilds.split(",");
            String resultFeildNamesArray[] = resultFeildNames.split(",");

            NamingEnumeration<SearchResult> answers = null;
            //
            ArrayList<ValueCollection> values = new ArrayList<ValueCollection>();

            try {
                String baseDn = "ou=accounts"; // TODO: Change me
                answers = adminContext.search(baseDn, filter, getSearchControlsForFetchUser(searchFeilds));
                SearchResult userInfo;
                if (!answers.hasMore()) {
                    // throw new Exception("User does not exist in AD");
                    return null;
                }
                try {
                    String Names = "";
                    int count = 0;

                    while (answers.hasMore()) {
                        ValueCollection data = new ValueCollection();
                        userInfo = (SearchResult) answers.next();
                        for (int i = 0; i < searchFeildsArray.length; i++) {
                            Attribute attr = userInfo.getAttributes().get(searchFeildsArray[i]);
                            if (attr != null) {
                                data.put(resultFeildNamesArray[i], new StringPrimitive(attr.get().toString()));
                            }
                        }
                        values.add(data);
                        String temp = userInfo.getAttributes().get("cn").get().toString();

                        if (!temp.equals(accountName)) {
                            Names = Names == "" ? temp : Names + "," + temp;
                            count++;
                        }
                    }
                    if (Names.length() > 0)
                        values = getData(Names, managerAttribute, adminContext, baseDn, searchFeilds, resultFeildNames,
                                values);
                    return values;
                } catch (PartialResultException var10) {
                    throw new Exception("User does not exist in AD or credentials are invalid");
                }
            } finally {
                if (answers != null) {
                    answers.close();
                }
            }
        } finally {
            if (adminContext != null) {
                adminContext.close();
            }
        }
    }

    private static ArrayList<ValueCollection> getData(String accountNames, String managerAttribute,
            InitialLdapContext adminContext, String baseDn, String searchFeilds, String resultFeildNames,
            ArrayList<ValueCollection> values) throws Exception {

        String filter = "";
        String[] Names = accountNames.split(",");
        filter = "(&(userstatus=active)(|";
        for (String Name : Names) {
            filter += "(" + managerAttribute + "=" + Name + ")";
        }
        filter += "))";

        String searchFeildsArray[] = searchFeilds.split(",");
        String resultFeildNamesArray[] = resultFeildNames.split(",");
        NamingEnumeration<SearchResult> answers = null;
        // String filter = "(" + managerAttribute + "=" + accountName + ")";
        answers = adminContext.search(baseDn, filter, getSearchControlsForFetchUser(searchFeilds));
        SearchResult userInfo;
        String SearchedUsers = "";
        int count = 0;
        while (answers.hasMore()) {
            ValueCollection data = new ValueCollection();
            userInfo = (SearchResult) answers.next();
            for (int i = 0; i < searchFeildsArray.length; i++) {
                Attribute attr = userInfo.getAttributes().get(searchFeildsArray[i]);
                if (attr != null) {
                    data.put(resultFeildNamesArray[i], new StringPrimitive(attr.get().toString()));
                }
            }
            values.add(data);
            String temp = userInfo.getAttributes().get("cn").get().toString();

            SearchedUsers = SearchedUsers == "" ? temp : SearchedUsers + "," + temp;
            count++;
        }
        if (SearchedUsers.length() > 0)
            values = getData(SearchedUsers, managerAttribute, adminContext, baseDn, searchFeilds, resultFeildNames,
                    values);
        return values;
    }

Answer 1

Congratulations! You are using the best LDAP server available.

I assume the default attributes are used for the hierarchy: manager for a person's manager and directReports for their subordinates. These are DN attributes, meaning they point directly to an object and you can read them instead of searching for them.

Case 1: directReports is available

The directReports attribute points downward in the organizational tree. If the directReports attribute is populated, you should proceed as follows:

1. Retrieve the specified user object and retrieve the directReports attribute
2. for every value of directReports that is returned, read the user object it points to, and retrieve their directReports attribute
3. Repeat step 2 for every value of directReports

If you store each user while iterating, you will end up with the required list.

Case 2: only manager is available

This is a little more work. The manager attribute points upwards in the organizational tree. You will have to search for users that have the given user as manager.

1. Retrieve the specified user object and get the DN (via SearchResult.getNameInNameSpace()
2. search for users with (manager=<DN>) where <DN> is the one you just resolved
3. for each result, get the DN and repeat step 2

If you store each user while iterating, you will end up with the required list.

Some more pointers:

• in your adminContext.search() the baseDN is either the value from directReports (case 1) or the normal base DN (case 2).
• searching for (manager=<accountname>) will not yield any results in your example because <accountname> is not a DN value (like cn=accountname,ou=users,o=org )