summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/baseldap.py
diff options
context:
space:
mode:
authorMartin Kosek <mkosek@redhat.com>2012-09-25 17:19:44 +0200
committerRob Crittenden <rcritten@redhat.com>2012-10-01 22:37:59 -0400
commit941d1e8701c0c3a22ab4e6320686761b64d89c82 (patch)
tree6ef2c2ca6709c6c5f946312e7c481411431a35d0 /ipalib/plugins/baseldap.py
parent0e432d33fc4123d70c320c66f00cd7a0082de163 (diff)
downloadfreeipa-941d1e8701c0c3a22ab4e6320686761b64d89c82.tar.gz
freeipa-941d1e8701c0c3a22ab4e6320686761b64d89c82.tar.xz
freeipa-941d1e8701c0c3a22ab4e6320686761b64d89c82.zip
Do not produce unindexed search on every DEL command
Every <plugin>-del command executes an "(objectclass=*)" search to find out if a deleted node has any child nodes which would need to be deleted first. This produces an unindexed search for every del command which biases access log audits and may affect performance too. Since most of the *-del commands delete just a single object (user, group, RBAC objects, SUDO or HBAC objects, ...) and not a tree (automount location, dns zone, ...) run a single entry delete first and only revert to subtree search&delete when that fails.
Diffstat (limited to 'ipalib/plugins/baseldap.py')
-rw-r--r--ipalib/plugins/baseldap.py8
1 files changed, 7 insertions, 1 deletions
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index 14a46f2d0..a55a23244 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -1424,7 +1424,13 @@ class LDAPDelete(LDAPMultiQuery):
except errors.NotFound:
self.obj.handle_not_found(*nkeys)
- delete_subtree(dn)
+ try:
+ self._exc_wrapper(nkeys, options, ldap.delete_entry)(dn, normalize=self.obj.normalize_dn)
+ except errors.NotFound:
+ self.obj.handle_not_found(*nkeys)
+ except errors.NotAllowedOnNonLeaf:
+ # this entry is not a leaf entry, delete all child nodes
+ delete_subtree(dn)
for callback in self.get_callbacks('post'):
result = callback(self, ldap, dn, *nkeys, **options)