Provision rate limiting

In case multiple admins perform parallel provisioning operations on the same machine it is advisable to restrict the provisioning rate for those accounts in case an account fires too many requests. To accomplish that a new rate limit was introduced which limits the amount of requests per admin in a one minute timeslot.

How it works

The requests are limited in constant one minute buckets. This means that it is theoretically possible for a single admin to perform up the the double amount of requests within a one minute timeframe if the requests are perfectly divided into two separate buckets.

The limit applies to all available apis (e.g. soap, rmi and clts) and is tracked cluster wide. It also covers SCIM provisioning and the HTTP gateway, whose requests act as the context administrator and therefore count against that administrator's limit.

What shares a limit

The limit belongs to an account, and an account is counted where it exists:

• A context administrator is counted per context. Contexts commonly name their administrator alike, oxadmin in every one of them, and those are different accounts; provisioning one context therefore never exhausts the rate of another.
• The master administrator is one account for the whole installation and is counted across all contexts, no matter which one it acts in.
• A reseller administrator is counted across the contexts it acts in as well, since it is one account above them.

A single request is not a single unit either: what counts is the provisioning call, and one request of the SCIM endpoint or the HTTP gateway can make several. The SCIM page lists what each of its requests costs.

Configuration

The rate limit is disabled by default (-1). Enable it by setting the com.openexchange.admin.rmi.rate.limit.default property to a positive value. E.g.:

com.openexchange.admin.rmi.rate.limit.default=200

Additionally you can also adjust the limit for an individual admin by using the com.openexchange.admin.rmi.rate.limit.[admin] property. E.g. for an admin with the name 'oxadmin':

com.openexchange.admin.rmi.rate.limit.oxadmin=150