Repository: privacyidea/privacyidea

Issue:
The Serverpool in LDAP resolver is not persistent
The serverpool in the ldap resolver is not persistent but rather created on each ``checkPass``.

As far as normal quering is concerned, it is persistent if the bind is still active. Nevertheless we should move the serverpool into a member ``self.serverpool``.


Discussion:

Resolving patch:
diff --git a/privacyidea/lib/resolvers/LDAPIdResolver.py b/privacyidea/lib/resolvers/LDAPIdResolver.py
--- a/privacyidea/lib/resolvers/LDAPIdResolver.py
+++ b/privacyidea/lib/resolvers/LDAPIdResolver.py
@@ -271,6 +271,7 @@ def __init__(self):
         self.start_tls = False
         self.serverpool_rounds = SERVERPOOL_ROUNDS
         self.serverpool_skip = SERVERPOOL_SKIP
+        self.serverpool = None
 
     def checkPass(self, uid, password):
         """
@@ -292,11 +293,12 @@ def checkPass(self, uid, password):
         else:
             bind_user = self._getDN(uid)
 
-        server_pool = self.get_serverpool(self.uri, self.timeout,
-                                          get_info=ldap3.NONE,
-                                          tls_context=self.tls_context,
-                                          rounds=self.serverpool_rounds,
-                                          exhaust=self.serverpool_skip)
+        if not self.serverpool:
+            self.serverpool = self.get_serverpool(self.uri, self.timeout,
+                                                  get_info=ldap3.NONE,
+                                                  tls_context=self.tls_context,
+                                                  rounds=self.serverpool_rounds,
+                                                  exhaust=self.serverpool_skip)
 
         try:
             log.debug("Authtype: {0!r}".format(self.authtype))
@@ -306,7 +308,7 @@ def checkPass(self, uid, password):
             if not bind_user or len(bind_user) < 1:
                 raise Exception("No valid user. Empty bind_user.")
             l = self.create_connection(authtype=self.authtype,
-                                       server=server_pool,
+                                       server=self.serverpool,
                                        user=bind_user,
                                        password=password,
                                        receive_timeout=self.timeout,
@@ -438,13 +440,14 @@ def _getDN(self, userId):
 
     def _bind(self):
         if not self.i_am_bound:
-            server_pool = self.get_serverpool(self.uri, self.timeout,
+            if not self.serverpool:
+                self.serverpool = self.get_serverpool(self.uri, self.timeout,
                                               get_info=self.get_info,
                                               tls_context=self.tls_context,
                                               rounds=self.serverpool_rounds,
                                               exhaust=self.serverpool_skip)
             self.l = self.create_connection(authtype=self.authtype,
-                                            server=server_pool,
+                                            server=self.serverpool,
                                             user=self.binddn,
                                             password=self.bindpw,
                                             receive_timeout=self.timeout,
@@ -744,6 +747,9 @@ def loadConfig(self, config):
             self.tls_context = None
         self.serverpool_rounds = int(config.get("SERVERPOOL_ROUNDS") or SERVERPOOL_ROUNDS)
         self.serverpool_skip = int(config.get("SERVERPOOL_SKIP") or SERVERPOOL_SKIP)
+        # The configuration might have changed. We reset the serverpool
+        self.serverpool = None
+        self.i_am_bound = False
 
         return self
 


Test patch: