I need to update group membership in Active Directory. This is done by adding a DN to the multi-valued attribute attached to the group named ‘member’.
The problem is, when reading or adding a multi-valued attribute into or out of Active Directory, using the LDAPReader and LDAPWriter, the entire multi-valued attribute gets put into a single field, on a single record. Like this…
member=“cn=user1,dc=domain,dc=com|cn=user2,dc=domain,dc=com|cn=user3,dc=domain,dc=com|…”
…so when I want to add a user to a group, I…
- Read the existing group record.
- Use the Normalize component to split the multiple values stored in the ‘member’ attribute into separate records.
- Add in the new records.
- Use Denormalize to stick all of the values back into a single record.
- Update the attribute
…the problem is, I may have 10,000 group members. Which gives me 25,000+ characters in the string that makes up the field.
CloverETL keeps running out of buffer memory, so I’ve updated the defaultProperties file to increase the memory…
Record.MAX_RECORD_SIZE = 1024000
DEFAULT_INTERNAL_IO_BUFFER_SIZE = 2048000
…which doesn’t feel right, considering the comment for MAX_RECORD_SIZE states…
“…keep it under 64K”
So I have two questions…
…is it okay to just keep increasing the buffer sizes until I can fit everything?
…is there a more memory efficient way to deal with reading and writing large multi-valued attributes out of and into LDAP?
Thanks…