Very slow adding/removing members to large groups

[rlees85]

I am finding it takes up to a minute and sometimes more to add a user to a large group. Removing some gaurds (optionally) could drastically improve the performance.

[zorn96]

hi @rlees85 ! have you tried using the skip_validation keyword argument on the functions? I added it for this purpose.
the docstring says

   :param skip_validation: If true, assume all distinguished names exist and do not look them up.
                           Defaults to False. This can be used to make this function more performant when
                           the caller knows all the distinguished names being specified are valid, as it
                           performs far fewer queries.

[rlees85]

Thanks for the reply @zorn96 . I have already been running with skip_validation=true since we do not need to validate in our use case.

The problem is fix=True in this line:

            res = member_modify_fn(member_dn_list, [group_dn], fix=True)

which calls ldap_connection.extend.microsoft.remove_members_from_groups or ldap_connection.extend.microsoft.add_members_to_groups.

The fix flag that is hard coded here basically causes ldap3 to pull back every member of the group, which in our case is tens of thousands.

[rlees85]

@zorn96 just wondered if any news on this? We have some scripts that would go from 60 seconds down to 2 or 3 if we could have a way of controlling this variable (fix). If you don't like my approach or naming would be very happy to discuss others