LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

This mapping allows LDAP-UX to support groupOfNames and groupOfUniqueNames for
defining membership of an HP-UX group.
Although there are many benefits to caching, administrators must be aware of the side-effects
of their use. Here are some examples to consider:
Table 7-4 ldapclientd Caching
Example Side-EffectBenefitsMap Name
Removing this information from
the directory may not be visible
to the operating system until
after the cache has expired. In
certain cases, this may allow a
user to login to an HP-UX host,
even after his account has been
removed from the LDAP
directory server. (In general this
is not a problem when pam_ldap
is used for authentication, since
authentication requests are not
cached.)
Reduces greatly the number of requests
sent to a directory server during a login
or other operation such as displaying
files owned by that user.
passwd
Removing a member of a group
may not be visible to the file
system, until after the cache
expires. During this window, a
user may be able to access files
or other resources based on
his/her group membership,
which had been revoked.
Frequent file system access may request
information about groups that own
particular files. Caching greatly reduces
this impact.
group
It is possible to alter the caching lifetime values for each service listed above, in the
/etc/opt/ldapux/ldapclientd.conf file. See below for additional information. It is also possible to
enable or disable a cache using the -E or -D (respectively) options. These options may be useful
in determining the effectiveness of caching or helpful in debugging.
ldapclientd Persistent Connections
Since the HP-UX can generate many requests to an LDAP server, the overhead of establishing a
single connection for every request can create excessive network traffic and slow response time
for name service requests. Depending on network latency, the connection establishment and
tear-down can cause relatively severe delays for client response. However, a persistent connection
to the directory server will eliminate this delay.
In the ldapclientd daemon, a pool of active connections is maintained to serve requests from the
Name Service Subsystem (NSS). If the NSS needs to perform a request to the directory server,
one of the free connections in this pool will be used. If there are no free connections in the pool,
a new connection will be established, and added to the pool. If system activity is low, then
connections that have been idle for a specified period of time (configurable in the ldapclientd.conf
file) then those connections will be dropped, to free up directory server resources. Aside from
ldapclientd connection time-out configuration, it is also possible to define a maximum number
of connections that ldapclientd may establish. Setting a high number of connections means assures
that ldapclientd will not become a bottleneck in performing name service operations to the
directory server. However, a high number of connections from a large number of HP-UX clients
to the same directory server may exhaust all available connection resources on that directory
server. Setting a low number of maximum connections will reduce that resource requirement
on the directory server, but may create a performance bottleneck in the ldapclientd.
Troubleshooting
This section describes problems you may encounter and troubleshooting techniques.
Troubleshooting 145