This topic provides suggestions for improving the performance of a FileNet P8-initiated search of the directory service for users and groups for Sun Java™ System Directory Server and Novell eDirectory.
This document recommends certain configurations of your Sun Java System Directory Server to better support FileNet P8, especially in the area of sorting.
Here are some Sun Java System Directory Server glossary definitions, for easy reference:
All IDs Threshold. A size limit which is globally applied to every index key managed by the server. When the size of an individual ID list reaches this limit, the server replaces that ID list with an All IDs token.
browsing index. Otherwise known as the virtual view index, speeds up the display of entries in the Directory Server Console. Browsing indexes can be created on any branch in the directory tree to improve display performance.
default index. One of a set of default indexes created per database instance. Default indexes can be modified, although care should be taken before removing them, as certain plug-ins might depend on them.
dn (distinguished name). String representation of an entry's name and location in an LDAP directory.
equality index. Allows you to search efficiently for entries containing a specific attribute value.
filter. A constraint applied to a directory query that restricts the information returned.
nsslapd-sizelimit (Size Limit). Specifies the maximum number of entries to return from a search operation. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded size limit error.
nsLookthroughLimit. Specifies the maximum number of entries that the directory will check when examining candidate entries in response to a search request.
substring index. Allows for efficient searching against substrings within entries. Substring indexes are limited to a minimum of two characters for each entry.
virtual list view index. Otherwise known as a browsing index, speeds up the display of entries in the Directory Server Console. Virtual list view indexes can be created on any branchpoint in the directory tree to improve display performance.
For information about the Sun Java System Directory Server features mentioned here, see:
Sun Java System Directory Server 5.2 Installation and Tuning Guide, "Chapter 7 Tuning Indexing."
Sun Java System Directory Server 5.1 or 5.2 Administration Guide, "Chapter 10 Managing Indexes."
To ensure proper sorting of a returned sublist in a Sun Java System Directory Server environment containing a large number of entries, you should make one or more of the following configuration changes:
NOTE The Directory Server might return an error when the Directory Server entry count is over this limit, regardless of whether the query is sorted.
NOTE Queries without a search pattern are used to retrieve all entries.
Simply increasing the All IDs Threshold by itself is not advisable, given the Sun Java System Directory Server recommendation to keep the All IDs Threshold value at about 5% of the Directory Server total entry count. Also, handling single-character searches without using a substring index could incur performance problems. Therefore it is recommended that you select an approach combining browsing index, substring index, and manipulating the All IDs Threshold. The following sections describe some of the issues to be resolved while implementing the recommendations.
Create a substring index for sorting attributes
For each attribute to be sorted, create a substring index in order to support the FileNet P8 pattern search. Remember that the Directory Server will still return an error if the entry count for a specific index is over the setting of All IDs Threshold.
You should enable a substring index for each attribute you assigned as Content Engine's UserShortNameAttribute, GroupShortNameAttribute, UserDisplayNameAttribute, and GroupDisplayNameAttribute. They are shown on the Directory Config tab of the Root Domain node in Enterprise Manager. For Content Engine, these attributes are normally uid and cn. For Process Engine, the sort attribute is cn (display attribute in peboot.ini.)
The substring index does not support the case of querying all users (which is done by leaving the FileNet P8 search string empty). This problem can be resolved by creating a browsing index, because the filter is static so only a few browsing entries are needed.
NOTES
Change the All IDs Threshold value
All queries will run as expected provided the All IDs Threshold is greater than the Directory Server entry count. The All IDs Threshold is a factor only when sorting is requested.
With the substring index enabled, a multi-character pattern search works as long as the Query entry count is less than All IDs Threshold.
Change the All IDs Threshold to a number greater than the Directory Server
entry count to ensure that single-character pattern searches work. There are,
however, some costs of doing so. For example, when an index for a specific attribute
value is over the All IDs Threshold value, the Directory Server will not maintain
the index list for that value. In order to resolve this problem, the All IDs
Threshold should be increased. The Sun recommendation is to keep the All IDs
Threshold value at about 5% of the Directory Server total entry count, but even
this percentage might have to be adjusted.
Example Assume the Directory Server has 80,000 entries and the threshold is 4000. Also assume there are 5000 entries that start with "pw" and 1000 entries that start with "au". When you query for "au*" you get 1000 entries, no error. But when you query "pw*" you would get an error because there are more than 4000 entries that start with "pw" (in fact there are 5000 entries) and Sun Java System Directory Server stops sorting for this case. You would have to increase the threshold to a number over 5000 in order to get back all entries that fulfill the query's specifications.
Effects of changing the All IDs Threshold without enabling a substring index
IBM conducted tests to show the effects of the All IDs Threshold without enabling a substring index.
Conclusions
Recommendation
How to create a browsing index
The substring index does not help queries without pattern. A query without pattern returns an error when the Directory Server entry count is over the All IDs Threshold value. To resolve this problem, you should create a browsing index for a static condition.
Here are steps to create a browsing index, (assuming the Short name and Display name of user entries is uid, the Short name and Display name of group entries is cn, the base DN is dc=eng,dc=filenet,dc=com):
dn: cn="dc=eng,dc=filenet,dc=com:(objectClass=person)",
cn=userRoot, cn=ldbm database, cn=plugins, cn=config
objectClass: top
objectClass: vlvSearch
cn: "dc=eng,dc=filenet,dc=com:(objectClass=person)"
vlvbase: dc=eng,dc=filenet,dc=com
vlvscope: 2
vlvfilter: (objectClass=person)
dn: cn=sort uid, cn="dc=eng,dc=FileNet,dc=com:(objectClass=person)",
cn=userRoot,cn=ldbm database, cn=plugins, cn=config
objectClass: top
objectClass: vlvIndex
cn: sort uid
vlvSort: uid
dn: cn=rev sort uid, cn="dc=eng,dc=filenet,dc=com:(objectClass=person)",cn=userRoot,cn=ldbm
database,cn=plugins,cn=config
objectClass: top
objectClass: vlvIndex
cn: rev sort uid
vlvSort: -uid
dn: cn="dc=eng,dc=filenet,dc=com:(objectClass=groupOfUniqueNames)",cn=userRoot,cn=ldbm
database,cn=plugins,cn=config
objectClass: top
objectClass: vlvSearch
cn: "dc=eng,dc=filenet,dc=com:(objectClass=groupOfUniqueNames)"
vlvbase: dc=eng,dc=filenet,dc=com
vlvscope: 2
vlvfilter: (objectClass=groupOfUniqueNames)
dn: cn=sort cn,cn=" dc=eng,dc=filenet,dc=com:(objectClass=groupOfUniqueNames)",cn=userRoot,cn=ldbm
database,cn=plugins,cn=config
objectClass: top
objectClass: vlvIndex
cn: sort cn
vlvSort: cn
dn: cn=rev sort cn,cn=" dc=eng,dc=filenet,dc=com:(objectClass=groupOfUniqueNames)",cn=userRoot,cn=ldbm
database,cn=plugins,cn=config
objectClass: top
objectClass: vlvIndex
cn: rev sort cn
vlvSort: -cn
dn: cn=sort_users_cn, cn="dc=eng,dc=FileNet,dc=com:(objectClass=person)",
cn=userRoot,cn=ldbm database, cn=plugins, cn=config
objectClass: top
objectClass: vlvIndex
cn: sort_users_cn
vlvSort: cn
dn: cn=rev_sort_users_cn , cn="dc=eng,dc=filenet,dc=com:(objectClass=person)",cn=userRoot,cn=ldbm
database,cn=plugins,cn=config
objectClass: top
objectClass: vlvIndex
cn: rev_sort_users_cn
vlvSort: -cn
The first three entries are browsing-index entries for querying users. The next three entries are browsing- index entries for querying groups. The last two are sort indexes on objectClass=person, based on cn instead of uid. Each vlvSearch entry is tied to a specific base DN and a specific filter. Note that both vlvSearch and vlvIndex entries should be named. In this example, the vlvSearch name is formed by concatenating the base DN and the filter as a unique name. For the user case, one vlvIndex is named sort uid and the second one is named rev sort uid. It is assumed that the user Short name attribute and Display name attribute are the same attribute: uid. If they are not the same, then two more vlvIndex entries should be added for another attribute. In this example, these vlvSearch and vlvIndex entries are specific to the base DN dc=eng,dc=filenet,dc=com. If there are more realms on the server, a new set of entries should be added for each realm.
<SUNONE_INSTALL_DIR>\shared\bin\ldapmodify -a -h <SUNONE_HOST_NAME>
-p <SUNONE_PORT_NUMBER> -D <USER_ID> -w <PASSWORD> -f <full
path of BrowsingIndex.txt>
<SUNONE_INSTALL_DIR>\bin\slapd\server\slapd db2index -D "<SUNONE_INSTALL_DIR>\slapd-<SUNONE_SERVER_NAME>"
-n <DB_NAME> -T "sort uid"
<SUNONE_INSTALL_DIR>\bin\slapd\server\slapd db2index -D "<SUNONE_INSTALL_DIR>\slapd-<SUNONE_SERVER_NAME>"
-n <DB_NAME> -T "rev sort uid"
<SUNONE_INSTALL_DIR>\bin\slapd\server\slapd db2index -D "<SUNONE_INSTALL_DIR>\slapd-<SUNONE_SERVER_NAME>"
-n <DB_NAME> -T "sort cn"
<SUNONE_INSTALL_DIR>\bin\slapd\server\slapd db2index -D "<SUNONE_INSTALL_DIR>\slapd-<SUNONE_SERVER_NAME>"
-n <DB_NAME> -T "rev sort cn"
Repeat the process above if there are more indexes added to the BrowsingIndex.txt
file.You can configure directory sorting options to ensure that users and groups are returned in a meaningful order by creating an index for each user and group short name and display name attribute (follow the Novell documentation). For example, add an index for cn and choose rule: substring.
Use ConsoleOne