LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Performance Impact for Dynamic Groups
The dynamic group is specified by a search filter. Depending on how you configure dynamic
groups, potentially, there could be a lot of LDAP searches involved. In that case, the performance
of those applications calling getgrnam(), getgrgid() or getgrent()(3C) (e.g. the command
"id", "groups", etc) will be affected.
In order to reduce the performance impact, LDAP-UX Client daemon, ldapclientd, caches
dynamic group information, including dynamic members that belongs to a specific group, and
dynamic groups that a specific user belongs to. The caching will reduce the response time the
ldapclientd daemon to return information. However, before the cache is established (i.e. the
very first request) or when the cache expires, you may experience longer response time. See the
“Configuring Dynamic Group Caches” section for detailed information on dynamic group
caching.
Enabling/Disabling enable_dynamic_getgroupsbymember
Processing dynamic groups that a specific user belongs to can potentially impact the user login
time. To control the operation for processing dynamic groups a specific user belongs to, LDAP-UX
Client Services supports the following configuration parameter,
disable_dynamic_getgroupsbymember, in the /etc/opt/ldapux/ldapux_client.conf
file:
enable_dynamic_getgroupsbymember
This integer variable controls whether to enable or disable the operation for processing dynamic
groups that a specific user belongs to. The valid values of this option are 1 and 0.
By default, LDAP-UX returns dynamic groups that a user belongs to if the group attribute,
memberUid, is mapped to msDS-AzLDAPQuery. If a user belongs to many dynamic groups,
he/she may experience an unexpected delay when logging into an HP-UX client system. You
can eliminate the delay by disabling LDAP-UX of returning dynamic groups that a specific user
belongs to unless he/she specifically uses the newgrp command. As a result, the user will not
have access granted to those dynamic groups, and the "id" command will not show those groups.
To disable it, set enable_dynamic_getgroupsbymember to 0. This parameter configuration
does not affect the operation of processing dynamic members for a specific group. The default
value is 1 to enable it.
NOTE: If the enable_dynamic_getgroupsbymember variable is set to 0, LDAP-UX will
still return dynamic members for a specific group. If you don't want dynamic members returned,
you must not include the msDS-AzLDAPQuery attribute in the memberUid group attribute
mappings, which completely disable the dynamic group functionality with LDAP-UX.
Configuring Dynamic Group Caches
To improve performance of dynamic groups, the ldapclient daemon, ldapclientd, caches
dynamic group members to reduce the LDAP-UX client response time while retrieving dynamic
group information. This cache is maintained in an independent memory space not shared with
the cache for other service data.
To configure dynamic group caches, set the parameters defined in the [dynamic_group] section
of the /etc/opt/ldapux/ldapxlientd.conf file. See “The ldapclientd.conf Configuration
File” (page 93) section in Chapter 7 (page 91) for details.
88 Dynamic Group Support