LDAP-UX Client Services B.04.15 Administrator's Guide

4.7 Performance Impact for Dynamic Groups
The dynamic group is specified by either an LDAP URL or a search filter. Depending on how
you configure dynamic groups, potentially, there could be a lot of LDAP searches involved. In
that case, the performance of those applications calling getgrnam(), getgrgid() or
getgrent()(3C) (e.g. the command "id", "groups", etc) will be affected.
In order to reduce the performance impact, LDAP-UX Client daemon, ldapclientd,, caches
dynamic group information, including dynamic members that belongs to a specific group, and
dynamic groups that a specific user belongs to. The caching will reduce the response time the
ldapclientd daemon to return information. However, before the cache is established (i.e. the
very first request) or when the cache expires, you may experience longer response time. See the
“Configuring Dynamic Group Caches” (page 81) section for detailed information on dynamic
group caching.
4.7.1 Enabling/Disabling enable_dynamic_getgroupsbymember
Processing dynamic groups that a specific user belongs to can potentially impact the user login
time. To control the operation for processing dynamic groups a specific user belongs to, LDAP-UX
Client Services supports the following configuration parameter,
disable_dynamic_getgroupsbymember, in the /etc/opt/ldapux/ldapux_client.conf
file:
enable_dynamic_getgroupsbymember
This integer variable controls whether to enable or disable the operation for processing dynamic
groups that a specific user belongs to. The valid values of this option are 1 and 0.
By default, LDAP-UX returns dynamic groups that a user belongs to if the group attribute,
memberUid, is mapped to memberURL or/and nxSearchFilter. If a user belongs to many
dynamic groups, he/she may experience an unexpected delay when logging into an HP-UX client
system.You can reduce the delay by disabling LDAP-UX of returning dynamic groups that a
specific user belongs to unless he/she specifically uses the newgrp command. As a result, the
user will not have access granted to those dynamic groups, and the "id" command will not show
those groups. To disable it, set enable_dynamic_getgroupsbymember to 0. This parameter
configuration does not affect the operation of processing dynamic members for a specific group.
The default value is 1 to enable it.
NOTE: If the enable_dynamic_getgroupsbymember variable is set to 0, LDAP-UX will
still return dynamic members for a specific group. If you don't want dynamic members returned,
you must not include the memberURL and nxSearchFilter attributes in the memberUid group
attribute mapping, which completely disables the dynamic group functionality with LDAP-UX.
4.8 Configuring Dynamic Group Caches
To improve performance of dynamic groups, the ldapclient daemon, ldapclientd, caches
dynamic group members to reduce the LDAP-UX client response time while retrieving dynamic
group information. This cache is maintained in an independent memory space not shared with
the cache for other service data.
To configure dynamic group caches, set the parameters defined in the [dynamic_group] section
of the /etc/opt/ldapux/ldapclientd.conf file. See “ldapclientd.conf” (page 85) in the
“Administering LDAP-UX Client Services” chapter for details.
4.7 Performance Impact for Dynamic Groups 81