Hi,

I've added about 20.000 users to LDAP and am experiencing
performance problems with login. It takes at least 15 seconds
before the login is completed and the next page is displayed.
(With only two users in LDAP there is an immediate response)

I'm wondering whether this is the result of using OpenLDAP
(versus an officially supported LDAP ...).
Is anyone using a supported LDAP for authentication with
that many users? How about performance when logging in?

It could be OpenLDAP (which we are using in this experimental
phase). However, using an LDAP browser (from softerra) I get
an immediate response when searching for a specific user so
OpenLDAP is not that slow ...
It's as if WebSphere is processing all users in LDAP sequentially
when logging in .... but that is probably not the case (I hope).

Silvain

[ Post a follow-up to this message ]

Not 100% certain on this subject anymore, but it is imperative I believe
that you configure WAS to be looking in the right portion of the tree and
that you configure WPS/WMM to do the same.

If your users are truly scattered throughout the tree then such a search may
be lengthy. Try searching the IBM support site for hits on this topic. I
believe it has been worked on for improvement, but there may be some
additional tips/suggestions available from that venue.

Thanks!

Scott
"Silvain Piree" <s.piree@enneya.com> wrote in message
news:ch99q9$6vje$1@news.boulder.ibm.com...
> Hi,
>
> I've added about 20.000 users to LDAP and am experiencing
> performance problems with login. It takes at least 15 seconds
> before the login is completed and the next page is displayed.
> (With only two users in LDAP there is an immediate response)
>
> I'm wondering whether this is the result of using OpenLDAP
> (versus an officially supported LDAP ...).
> Is anyone using a supported LDAP for authentication with
> that many users? How about performance when logging in?
>
> It could be OpenLDAP (which we are using in this experimental
> phase). However, using an LDAP browser (from softerra) I get
> an immediate response when searching for a specific user so
> OpenLDAP is not that slow ...
> It's as if WebSphere is processing all users in LDAP sequentially
> when logging in .... but that is probably not the case (I hope).
>
> Silvain
>
>

[ Post a follow-up to this message ]

If you are using groups, make sure you don't use groupOfUniqueNames - use
groupOfNames instead..

the uniqueMember attribute for groupOfUniqueNames is not an indexable field
(hence, slow).

Moreover, double check the attribute it's using during logins.  Make sure
said attribute(s) are indexed (slapd.conf) file.



"Silvain Piree" <s.piree@enneya.com> wrote in message
news:ch99q9$6vje$1@news.boulder.ibm.com...
> Hi,
>
> I've added about 20.000 users to LDAP and am experiencing
> performance problems with login. It takes at least 15 seconds
> before the login is completed and the next page is displayed.
> (With only two users in LDAP there is an immediate response)
>
> I'm wondering whether this is the result of using OpenLDAP
> (versus an officially supported LDAP ...).
> Is anyone using a supported LDAP for authentication with
> that many users? How about performance when logging in?
>
> It could be OpenLDAP (which we are using in this experimental
> phase). However, using an LDAP browser (from softerra) I get
> an immediate response when searching for a specific user so
> OpenLDAP is not that slow ...
> It's as if WebSphere is processing all users in LDAP sequentially
> when logging in .... but that is probably not the case (I hope).
>
> Silvain
>
>

[ Post a follow-up to this message ]