---
title: Resource limits
description: You can set limits on search operations:
component: pingds
version: 7.3
page_id: pingds:maintenance-guide:resource-limits
canonical_url: https://docs.pingidentity.com/pingds/8.1/use-cases/limits.html
llms_txt: https://docs.pingidentity.com/pingds/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2023-09-11T07:37:39Z
keywords: ["Features", "LDAP", "Performance", "Setup & Configuration"]
superseded_by: https://docs.pingidentity.com/pingds/8.1/use-cases/limits.html
section_ids:
  limit-search-resources: Search limits
  set-search-limits-per-user: Set limits for a user
  set-search-limits-per-group: Set limits for users in a group
  limit-concurrent-psearches: Limit persistent searches
  limit-concurrent-connections: Connection limits
  limit-total-concurrent-connections: Limit total connections
  restrict-which-clients-connect: Restrict who can connect
  limit-per-client-concurrent-connections: Limit connections per client
  limit-idle-time: Idle time limits
  limit-max-request-size: Request size limits
---

# Resource limits

## Search limits

You can set limits on search operations:

* The *size limit* sets the maximum number of entries returned for a search.

  The default size limit of 1000 is set by the global server property `size-limit`.

  You can override the limit per user with the operational attribute, `ds-rlim-size-limit`.

  Search requests can include a size limit setting. The `ldapsearch` command has a `--sizeLimit` option.

* The *time limit* defines the maximum processing time for a search operation.

  The default time limit of 1 minute is set by the global server property `time-limit`.

  You can override the limit on a per user basis with the operational attribute, `ds-rlim-time-limit`. Times for `ds-rlim-time-limit` are expressed in seconds.

  In addition, search requests themselves can include a time limit setting. The `ldapsearch` command has an `--timeLimit` option.

* The *idle time limit* defines how long an idle connection remains open.

  No default idle time limit is set. You can set an idle time limit by using the global server property `idle-time-limit`.

  You can override the limit on a per user basis with the operational attribute, `ds-rlim-idle-time-limit`. Times for `ds-rlim-idle-time-limit` are expressed in seconds.

* The maximum number of persistent searches is set by the global server property `max-psearches`.

### Set limits for a user

1. Give an administrator access to update the operational attributes related to search limits:

   ```bash
   $ ldapmodify \
    --hostname localhost \
    --port 1636 \
    --useSsl \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --bindDN uid=admin \
    --bindPassword password << EOF
   dn: ou=People,dc=example,dc=com
   changetype: modify
   add: aci
   aci: (targetattr = "ds-rlim-time-limit||ds-rlim-size-limit")
    (version 3.0;acl "Allow Kirsten Vaughan to manage search limits";
    allow (all) (userdn = "ldap:///uid=kvaughan,ou=People,dc=example,dc=com");)
   EOF
   ```

2. Change the user entry to set the limits to override:

   ```bash
   $ ldapmodify \
    --hostname localhost \
    --port 1636 \
    --useSsl \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --bindDN uid=kvaughan,ou=people,dc=example,dc=com \
    --bindPassword bribery << EOF
   dn: uid=bjensen,ou=People,dc=example,dc=com
   changetype: modify
   add: ds-rlim-size-limit
   ds-rlim-size-limit: 10
   EOF
   ```

   When Babs Jensen performs an indexed search returning more than 10 entries, she reads the following message:

   ```bash
   $ ldapsearch \
    --hostname localhost \
    --port 1636 \
    --useSsl \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --bindDN uid=bjensen,ou=people,dc=example,dc=com \
    --bindPassword hifalutin \
    --baseDN dc=example,dc=com \
    "(sn=jensen)"

   # The LDAP search request failed: 4 (Size Limit Exceeded)
   # Additional Information:  This search operation has sent the maximum of 10 entries to the client
   ```

### Set limits for users in a group

1. Give an administrator the privilege to write subentries:

   ```bash
   $ ldapmodify \
    --hostname localhost \
    --port 1636 \
    --useSsl \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --bindDN uid=admin \
    --bindPassword password << EOF
   dn: uid=kvaughan,ou=People,dc=example,dc=com
   changetype: modify
   add: ds-privilege-name
   ds-privilege-name: subentry-write
   EOF
   ```

   Notice here that the directory superuser, `uid=admin`, assigns privileges. Any administrator with the `privilege-change` privilege can assign privileges. However, if the administrator can update administrator privileges, they can assign themselves the `bypass-acl` privilege. Then they are no longer bound by access control instructions, including both user data ACIs and global ACIs. For this reason, do not assign the `privilege-change` privilege to normal administrator users.

2. Create an LDAP subentry to specify the limits using collective attributes:

   ```bash
   $ ldapmodify \
    --hostname localhost \
    --port 1636 \
    --useSsl \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --bindDN uid=kvaughan,ou=people,dc=example,dc=com \
    --bindPassword bribery << EOF
   dn: cn=Remove Administrator Search Limits,dc=example,dc=com
   objectClass: collectiveAttributeSubentry
   objectClass: extensibleObject
   objectClass: subentry
   objectClass: top
   cn: Remove Administrator Search Limits
   ds-rlim-size-limit;collective: 0
   ds-rlim-time-limit;collective: 0
   subtreeSpecification: {base "ou=people", specificationFilter
     "(isMemberOf=cn=Directory Administrators,ou=Groups,dc=example,dc=com)" }
   EOF
   ```

   The `base` entry identifies the branch that holds administrator entries. For details on how subentries apply, refer to [About subentry scope](../config-guide/collective-attrs.html#subentry-scope).

3. Check the results:

   ```bash
   $ ldapsearch \
    --hostname localhost \
    --port 1636 \
    --useSsl \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --bindDN uid=kvaughan,ou=people,dc=example,dc=com \
    --bindPassword bribery \
    --baseDN uid=kvaughan,ou=people,dc=example,dc=com \
    --searchScope base \
    "(&)" \
    ds-rlim-time-limit ds-rlim-size-limit

   dn: uid=kvaughan,ou=People,dc=example,dc=com
   ds-rlim-size-limit: 0
   ds-rlim-time-limit: 0
   ```

### Limit persistent searches

An LDAP persistent search maintains an open a connection that may be idle for long periods of time. Whenever a modification changes data in the search scope, the server returns a search result. The more concurrent persistent searches, the more work the server has to do for each modification:

1. Set the global property `max-psearches` to limit total concurrent persistent searches.

   The following example limits the maximum number of persistent searchees to 30:

   ```bash
   $ dsconfig \
    set-global-configuration-prop \
    --hostname localhost \
    --port 4444 \
    --bindDN uid=admin \
    --bindPassword password \
    --set max-psearches:30 \
    --usePkcs12TrustStore /path/to/opendj/config/keystore \
    --trustStorePassword:file /path/to/opendj/config/keystore.pin \
    --no-prompt
   ```

## Connection limits

### Limit total connections

Each connection uses memory. On UNIX and Linux systems, each connection uses an available file descriptor.

To limit the total number of concurrent client connections that the server accepts, use the global setting `max-allowed-client-connections`. The following example sets the limit to 64K. 64K is the minimum number of file descriptors that should be available to the DS server:

```bash
$ dsconfig \
 set-global-configuration-prop \
 --hostname localhost \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --set max-allowed-client-connections:65536 \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

### Restrict who can connect

To restrict which clients can connect to the server, use the global setting `allowed-client`, or `denied-client`. The following example restricts access to clients from the `example.com` domain:

```bash
$ dsconfig \
 set-global-configuration-prop \
 --hostname localhost \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --set allowed-client:example.com \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

Set these properties per `Connection Handler`. The settings on a connection handler override the global settings.

### Limit connections per client

To limit the number of concurrent connections from a client, use the global settings `restricted-client`, and `restricted-client-connection-limit`. The following example sets the limit for all clients on the `10.0.0.*` network to 1000 concurrent connections:

```bash
$ dsconfig \
 set-global-configuration-prop \
 --hostname localhost \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --set restricted-client:"10.0.0.*" \
 --set restricted-client-connection-limit:1000 \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

Set these properties per `Connection Handler`. The settings on a connection handler override the global settings.

The server applies the properties in this order:

1. If the `denied-client` property is set, the server denies connections from any client matching the settings.

2. If the `restricted-client` property is set, the server checks the number of connections from any client matching the settings.

   If a matching client exceeds `restricted-client-connection-limit` connections, the server refuses additional connections.

3. If the `allowed-client` property is set, the server allows connections from any client matching the settings.

4. If none of the properties are set, the server allows connections from any client.

## Idle time limits

If client applications leave connections idle for long periods, you can drop their connections by setting the global configuration property [idle-time-limit](../configref/objects-global.html#idle-time-limit). By default, no idle time limit is set.

If your network is configured to drop connections that have been idle for some time, set the DS idle time limit to a lower value than the idle time limit for the network. This helps to ensure that idle connections are shut down in orderly fashion. Setting the DS limit lower than the network limit is particularly useful with networks that drop idle connections without cleanly closing the connection and notifying the client and server.

|   |                                                                 |
| - | --------------------------------------------------------------- |
|   | DS servers do not enforce idle timeout for persistent searches. |

The following example sets the idle-time-limit to 24 hours:

```bash
$ dsconfig \
 set-global-configuration-prop \
 --hostname localhost \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --set idle-time-limit:24h \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

## Request size limits

The default maximum request size is 5 MB. This is sufficient for most deployments. In cases where clients add groups with large numbers of members, requests can exceed the 5 MB limit.

The following example increases the limit to 20 MB for the LDAP connection handler:

```bash
$ dsconfig \
 set-connection-handler-prop \
 --hostname localhost \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --handler-name LDAP \
 --set max-request-size:20mb \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

This setting affects only the size of requests, not responses.