PQ94008: Use objectCategory instead of objectClass to search MSAD server

 Fixes are available

5.1.1.8: WebSphere Application Server 5.1.1 Cumulative Fix 8 for AIX
5.1.1.8: WebSphere Application Server 5.1.1 Cumulative Fix 8 for Windows
5.1.1.8: WebSphere Application Server 5.1.1 Cumulative Fix 8 for HP-UX
5.1.1.8: WebSphere Application Server 5.1.1 Cumulative Fix 8 for Solaris
5.1.1.6: WebSphere Application Server Version 5.1.1 Cumulative Fix 6
5.1.1.7: WebSphere Application Server Version 5.1.1 Cumulative Fix 7
5.1.1.4: WebSphere Application Server Version 5.1.1 Cumulative Fix 4
5.1.1.8: WebSphere Application Server 5.1.1 Cumulative Fix 8 for Linux



APAR status
Closed as program error.

Error description
Operating System and Level:Windows 2000
WAS 6 uses inefficient less than optimal search filters for
Active Directory. By default WAS 6 uses objectClass to search
Active Directory, it should use objectCategory which is indexed
and has a better performance.

This seems to have been fixed in V6 under cmvc defect 225376.
Now, we need to backport it to V5 and V4.
Local fix
Filters can be manually modified, and "Custom" registry "type"
used.
Problem summary
****************************************************************
* USERS AFFECTED: WebSphere Application Server users who have  *
*                 enabled Global Security and configured       *
*                 Microsoft Active Directory Server as the     *
*                 LDAP server in use.                          *
****************************************************************
* PROBLEM DESCRIPTION: The default search filters in           *
*                      Microsoft Active Directory server are   *
*                      not optimized.                          *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
In previous release, the default search filter for Microsoft
Active Directory server was based on ObjectClass, which is not
indexed, and may result in slower search response.

Search filters using ObjectCategory were documented as
replacements for the default filters to resolve the performance
problem with the default filters.  These new filters now
replace the original filters as the default filters.
Problem conclusion
This is a performance improvement for user suing Microsoft
Active Directory server as the ocnfigured LDAP server.  This
is change the default search filters.  The original filters
can still be used by editing the filters and creating a
"Custom" LDAP configuration.

If security is already enabled prior to applying this fix,
the existing search filters will not be changed until
the LDAP settings are re-applied by choosing Microsoft Active
Directory server and saving LDAP configuration.

Important not:  If the original filters are still wanted,
"Custom" must be selected as the LDAP server before applying
any changes for the LDAP configuration.

If security is enabled after applying this fix, the new
search filters will be used automatically.

New filters:
user: (&(sAMAccountName=%v)(objectcategory=user))
group: (&(cn=%v)(objectcategory=group))

Original Filters:
user: (&(sAMAccountName=%v)(objectclass=user))
group: (&(cn=%v)(objectclass=group))
Temporary fix
tested at local lab
Comments
APAR information
APAR number PQ94008
Reported component name WAS BASE 5.0
Reported component ID 5630A3600
Reported release 10W
Status CLOSED PER
PE NoPE
HIPER NoHIPER
Special Attention NoSpecatt
Submitted date 2004-09-09
Closed date 2004-11-16
Last modified date 2004-11-16

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Modules/Macros
SECURITY          

Publications Referenced

Fix information

Applicable component levels
R003 PSY    UP
R00A PSY    UP
R00H PSY    UP
R00I PSY    UP
R00P PSY    UP
R00S PSY    UP
R00W PSY    UP
R103 PSY    UP
R10A PSY    UP
R10H PSY    UP
R10I PSY    UP
R10P PSY    UP
R10S PSY    UP
R10W PSY    UP


Document Information


Product categories: Software > Application Servers > Distributed Application & Web Servers > WebSphere Application Server > General
Operating system(s):
Software version: 10W
Software edition:
Reference #: PQ94008
IBM Group: Software Group
Modified date: Nov 16, 2004