Repository navigation
[1.0.0] Optimize search entry filtering and ACL checks. - #368
Merged
ChadSikorra merged 4 commits intoOct 19, 2026
Merged
Conversation
* Seed the comparison with person entries. * Run every side of a comparison under its own access control. * Probe the run identity's writes before a comparison seeds. * Count the entries a size-limited search returned in the load test.
An identity's read decisions are now taken once per request for each attribute. Only rules that depend on the entry's DN are asked per entry. A single gate applies them together with the selection so an entry is rebuilt at most once.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #368 +/- ##
============================================
+ Coverage 89.93% 90.07% +0.13%
Complexity 31 31
============================================
Files 745 755 +10
Lines 29411 31720 +2309
============================================
+ Hits 26451 28572 +2121
- Misses 2960 3148 +188 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This drastically reduces the number of walks we need to make per entry per attribute in the search path. Read decisions are now taken once per request for each attribute. There also some schema memoization / caching regarding subtype checks and operational attribute usage. This is really the last area of major optimization left in the search path. What remains is related to nagle's algorithm (in PCNTL) and also BER encoding (which is already heavily optimized in PHP). That would likely need some optional PHP extension to make any more gains.
This also makes the LDAP comparison bench more "fair". Fair in that all references now use ACL and bind as a user that doesn't bypass everything. It also uses more normal people entry seeds and attribute sizes. The comparisons are now kind of interesting, and I'm surprised how much performance you can squeeze out of PHP (especially with swoole).