LDAP realm caching

Elastic Stack Elasticsearch
1

Is the ldap realm setting cache.ttl for Authorization, Authentication or both?
We are currently seeing Elasticsearch doing 15000 searches an hour to our Ldap server.

We have not explicitly set the field value ourselves, but documentation says there is a 20m default.

Also worth noting we are running in ECE if that has an affect on any config settings.

Many thanks

2

Hi @JamesNotJamez,

The setting cache.ttl is used to cache user entries where the resolved roles and credentials are cached for 20 minutes by default. So yes it is used for Authentication and Authorization.
Note: that reads through cache do not prevent cache entry expiry

Could you please provide some more details?

  • What version of Elasticsearch are you using?
  • enable the debug logs on ES for org.elasticsearch.xpack.security.authc.ldap and share the logs?
  • no of unique logins to the ES server within that hour, you can look through audit logs.

Hope this helps.

Thanks and Regards,
Yogesh Gaikwad

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.