Understanding LDAP connector iterate modes and paging

[#1]

• Product
• Question
• Answer

Product

IdentityIQ 6.x; IdentityIQ 7.x

Question

How is iterateModeOverride used and how does an LDAPConnector type application set the iterate mode?

Answer

Paging is used for LDAP based connectors (including ADLDAPConnector). The LDAP connector class checks the LDAP server's paging capabilities, looks to see if an override is set, then sets the iterate mode accordingly. When the connector for the application checks the supported controls for the LDAP server (whether it be Active Directory, OpenLDAP, etc.) it looks for: PagedResultsControl for Paged Results and VirtualListViewResponseControl for Virtual List View. Here is the processing by which the connector determines which iterate mode to use:

1. Check if the VirtualListViewResponseControl (VLV) control is available on the LDAP server.

2. Check if the PagedResultsControl (Paged Results) control is available on the LDAP server.

3. If both VLV and Paged Results are available, use Paged Results because of a Microsoft issue.

4. If just one is available, use the one that is found.

5. If neither is available, use “DEFAULT”.

And here are some things to note regarding the iterate mode for each iterate mode type:

• DEFAULT does not using paging. So PageSize is not used for DEFAULT.
• If the default mode is used, only the DN is initially returned and then the connector binds back to the object and fills in the attributes during the iteration.
• Both VLV and paged result controls use paging.
• The VLV control is a newer control.
• You can explicitly set the iterate mode with one of these values: PAGED_RESULTS,  VIRTUAL_LIST_VIEW, DEFAULT. Use this format in the application xml:<entry key="iterateModeOverride" value="PAGED_RESULTS"/>

Generally, an override does not need to be set. It should only be set in unique circumstances when the override is necessary.