LDAP-UX client with Active Directory is slow.

[Kevin Conley]

Hi All,

I have LDAP-UX set up to talk to Active Directory. I have caching enabled but pwgets take about .5 seconds even when cached. They take 1.5 seconds if they aren't.

Is this typical? I was expecting that cached entries would be faster.

Thanks,
Kevin

[Viktor Balogh]

There is a so-called password caching daemon, look for it in the process tree if it is running.

# ps -ef | grep pwgrd

You can see it's hit ratio with the interactive pwgr_stat command.

[Kevin Conley]

I've looked at this and it helps with caching the password that's used to talk to the AD server but not for the UID to account lookups that I'm doing. I even turned on the "with NIS+" option. The cache and hash hit rate is 0.00%.

Other thoughts?

[Bob Neal-Joslin]

Hi Kevin,

Once cached, lookups should be very quick. Are you doing your tests using pwget [man pwget(1)] and seeing the slow results or some other method? And are you doing enumeration or just single lookups (sounds like the later).

One thing you could try is see if the performance can be attributed directly to LDAP-UX or the directory server. Try this ldapsearch command and see how long it takes.

/opt/ldapux/bin/ldapsearch -b "" -h "" -D "username@domain" -w "" "(&(objectclass=user)(uidnumber=))" dn

If that's fast, then there is something going on inside ldapux itself.

One other thing to do would be to post data from your ldapclientd configuration and statistics. Could you post the contents /etc/opt/ldapux/ldapclientd.conf and /etc/nsswitch.conf. And also, could you display the output of /opt/ldapux/bin/ldapclientd -S passwd, both before and after running the "pwget -u " command?

Be sure to check that no confidential data is in any of the output you post.

BTW, I'm not sure what you mean by "with NIS+". Could you clarify?

Bob

[Kevin Conley]

I have adjusted the base dn to just look in the OU=User_Accounts. That helped quite a bit.

The other thing that I discovered after painful scrutiny is that the ldapclientd.conf file I had (from one of the templates) did not have poscache_ttl or negcache_ttl values in each of the cache sections, i.e. passwd.

UGGGGGHHHHhhhh!

After I added those entries for the things I wanted to cache, I could use pwget -n on 1000 unique users and it would cache them in 2 minutes, 15 seconds. Then I could re-run that same set of users and it finished in 35 seconds!

That's much closer to what I would have expected.

Thanks,
Kevin

[Bob Neal-Joslin]

Hi Kevin,

Glad you worked it out. Just so you know, the default cache time (if it's enabled but not specified in the ldapclientd.conf file) for passwd and group is 120 seconds. The defaults are listed in the ldapclientd.conf man page "man 4 ldapclient.conf". The 4 is required because the man subsystem trims names and thus would not be able to distinguish from the ldapclientd(1m) man page.)

Bob