LDAP-UX Client Services B.05.00 Administrator's Guide

4.6 Performance impact for dynamic groups
The dynamic group is specified by either an LDAP URL or a search filter. Depending on how
you configure dynamic groups, potentially, there could be a lot of LDAP searches involved. In
that case, the performance of those applications calling getgrnam(), getgrgid() or
getgrent()(3C) (e.g. the command "id", "groups", etc) will be affected.
To reduce the performance impact, the LDAP-UX client daemon (ldapclientd), caches dynamic
group information, including dynamic members that belongs to a specific group, and dynamic
groups that a specific user belongs to. The caching will reduce the response time the ldapclientd
daemon to return information. However, before the cache is established (i.e. the very first request)
or when the cache expires, you may experience longer response time. See Section 4.7 (page 128)
for detailed information on dynamic group caching.
4.6.1 Enabling/disabling enable_dynamic_getgroupsbymember
Processing dynamic groups that a specific user belongs to can potentially impact the user login
time. To control the operation for processing dynamic groups a specific user belongs to, LDAP-UX
Client Services supports the following configuration parameter,
disable_dynamic_getgroupsbymember, in the /etc/opt/ldapux/ldapux_client.conf
file:
enable_dynamic_getgroupsbymember
This integer variable controls whether to enable or disable the operation for processing dynamic
groups that a specific user belongs to. The valid values of this option are 1 and 0.
By default, LDAP-UX returns dynamic groups that a user belongs to if the group attribute,
memberUid, is mapped to memberURL or/and nxSearchFilter. If a user belongs to many
dynamic groups, he/she may experience an unexpected delay when logging into an HP-UX client
system.You can reduce the delay by disabling LDAP-UX of returning dynamic groups that a
specific user belongs to unless he/she specifically uses the newgrp command. As a result, the
user will not have access granted to those dynamic groups, and the "id" command will not show
those groups. To disable it, set enable_dynamic_getgroupsbymember to 0. This parameter
configuration does not affect the operation of processing dynamic members for a specific group.
The default value is 1 to enable it.
NOTE: If the enable_dynamic_getgroupsbymember variable is set to 0, LDAP-UX will
still return dynamic members for a specific group. If you don't want dynamic members returned,
you must not include the memberURL and nxSearchFilter attributes in the memberUid group
attribute mapping, which completely disables the dynamic group functionality with LDAP-UX.
4.7 Configuring dynamic group caches
To improve performance of dynamic groups, the LDAP client daemon, ldapclientd, caches
dynamic group members to reduce the LDAP-UX client response time while retrieving dynamic
group information. This cache is maintained in an independent memory space not shared with
the cache for other service data.
To configure dynamic group caches, set the parameters defined in the [dynamic_group] section
of the /etc/opt/ldapux/ldapclientd.conf file. See Section 5.1.3 (page 131) for details.
128 Dynamic group support