Merge "Document LDAP marker pagination as unsupported; fix sizelimit pool poisoning"

keystone/identity/backends/ldap/common.py

@@ -1865,7 +1865,13 @@ class BaseLdap:
                 + list(self.extra_attr_mapping.keys())
             )
         )
-        sizelimit = hints.limit['limit'] if hints and hints.limit else 0
+        # Always fetch the full result set from LDAP (sizelimit=0 means
+        # unlimited). Passing a sizelimit to _paged_search_s abandons the
+        # server-side cursor mid-page, poisoning the connection pool and
+        # making subsequent requests return empty results non-deterministically.
+        # Truncation to the requested limit is handled in Python by the
+        # @driver_hints.truncated decorator after the full set is returned.
+        sizelimit = 0
 
         with self.get_connection() as conn:
             try:

keystone/tests/unit/identity/backends/test_ldap_common.py

@@ -721,6 +721,22 @@ class LDAPPagedResultsTest(unit.TestCase):
 
         self.assertLessEqual(len(users), list_limit)
 
+    def test_marker_ignored_for_ldap_domain(self):
+        """LDAP backends do not support marker pagination; markers are ignored.
+
+        LDAP has no native keyset pagination and the server-side paging cookie
+        cannot survive across stateless HTTP requests.  Client-side emulation
+        would require a full directory scan on every page request, which is
+        unacceptable at scale.  The correct behaviour is to ignore the marker
+        and return results from the beginning of the list, capped by
+        list_limit.  This test pins that behaviour so future developers do not
+        mistake it for a bug and attempt to "fix" it with an O(N) full fetch.
+        """
+        hints = driver_hints.Hints()
+        hints.set_marker(uuid.uuid4().hex)
+        users = PROVIDERS.identity_api.list_users(hints=hints)
+        self.assertEqual(len(default_fixtures.USERS), len(users))
+
 
 class CommonLdapTestCase(unit.BaseTestCase):
     """These test cases call functions in keystone.common.ldap."""

releasenotes/notes/fix-ldap-marker-pagination-3b8e21f4c9d70a15.yaml

@@ -0,0 +1,14 @@
+---
+fixes:
+  - |
+    [`bug 2161103 <https://bugs.launchpad.net/keystone/+bug/2161103>`_]
+    LDAP-backed domains do not support marker-based (keyset) pagination.
+    LDAP has no native keyset pagination, and the session cookie required
+    for native LDAP paging cannot survive across stateless HTTP requests in
+    a multi-node deployment.  Attempting client-side emulation (fetching all
+    entries to find the marker position) would incur a full directory scan
+    on every page request, which is unacceptable for large directories.
+
+    The ``list_limit`` setting continues to cap the number of entries
+    returned per request.  Callers should not rely on ``next`` link markers
+    for LDAP-backed domains.