Do not log LDAP write ops by default

backend/ldap/tx.go

@@ -8,6 +8,8 @@ import (
 	"github.com/go-ldap/ldap/v3"
 )
 
+var debugLDAP = false
+
 // Generic interface to LDAP - allows us to stub out the LDAP client while
 // testing.
 type ldapConn interface {
@@ -132,14 +134,18 @@ func (tx *ldapTX) Commit(ctx context.Context) error {
 			if isEmptyAddRequest(ar) {
 				continue
 			}
-			log.Printf("issuing AddRequest: %+v", ar)
+			if debugLDAP {
+				log.Printf("issuing AddRequest: %+v", ar)
+			}
 			err = tx.conn.Add(ctx, ar)
 		} else {
 			mr := mods[dn]
 			if isEmptyModifyRequest(mr) {
 				continue
 			}
-			log.Printf("issuing ModifyRequest: %+v", mr)
+			if debugLDAP {
+				log.Printf("issuing ModifyRequest: %+v", mr)
+			}
 			err = tx.conn.Modify(ctx, mr)
 		}
 		if err != nil {
@@ -190,7 +196,9 @@ func (tx *ldapTX) updateModifyRequest(ctx context.Context, mr *ldap.ModifyReques
 	// perform an Add or a Replace.
 	old, ok := tx.rcache[cacheKey(attr.dn, attr.attr)]
 	if !ok {
-		log.Printf("tx: pessimistic fallback for %s %s", attr.dn, attr.attr)
+		if debugLDAP {
+			log.Printf("tx: pessimistic fallback for %s %s", attr.dn, attr.attr)
+		}
 		oldFromLDAP := tx.readAttributeValuesNoCache(ctx, attr.dn, attr.attr)
 		if len(oldFromLDAP) > 0 {
 			ok = true