HADOOP-10626. Limit Returning Attributes for LDAP search. Contributed by Jason Hubbard.

(cherry picked from commit 8709751e1ee9a2c5553823dcd715bd077052ad7f)

hadoop-common-project/hadoop-common/CHANGES.txt

@@ -144,6 +144,9 @@ Release 2.7.0 - UNRELEASED
     HADOOP-4297. Enable Java assertions when running tests.
     (Tsz Wo Nicholas Sze via wheat9)
 
+    HADOOP-10626. Limit Returning Attributes for LDAP search. (Jason Hubbard
+    via atm)
+
   OPTIMIZATIONS
 
     HADOOP-11323. WritableComparator#compare keeps reference to byte array.

hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/LdapGroupsMapping.java

@@ -341,6 +341,8 @@ public class LdapGroupsMapping
 
     int dirSearchTimeout = conf.getInt(DIRECTORY_SEARCH_TIMEOUT, DIRECTORY_SEARCH_TIMEOUT_DEFAULT);
     SEARCH_CONTROLS.setTimeLimit(dirSearchTimeout);
+    // Limit the attributes returned to only those required to speed up the search. See HADOOP-10626 for more details.
+    SEARCH_CONTROLS.setReturningAttributes(new String[] {groupNameAttr});
 
     this.conf = conf;
   }