Optimizing the Connection Pool Size and User Cache

5-16 Securing Oracle WebLogic Server ■ Enabling a cache involves a trade-off of performance and accuracy. Using a cache means that data is retrieved faster, but runs the risk that the data may not be the latest available. ■ The time-to-live TTL setting how long you are willing to accept potentially stale data. This depends a lot on your particular business needs. If you frequently changes group memberships for users, then a long TTL could mean that group related changes wont show up for a while, and you may want a short TTL. If group memberships almost never change after a user is added, a longer TTL may be fine. ■ The cache size is related to the amount of memory you have available, as well as the cache TTL. Consider the number of entries that might be loaded in the span of the TTL, and size the cache in relation to that number. A longer TTL will tend to require a larger cache size.

5.4.10.2 Optimizing the Connection Pool Size and User Cache

When configuring any of the LDAP Authentication providers, you can improve the performance of the connection between WebLogic Server and the LDAP server by optimizing the size of the LDAP connection pool and user cache. To make these optimizations, complete the following steps:

1. Set the LDAP connection pool size to 100 by using either of the following methods:

■ Define the following system property in the setDomainEnv script, which is located in the bin directory of the WebLogic domain: -Dweblogic.security.providers.authentication.LDAPDelegatePoolSize=100 ■ In the WebLogic Server Administration Console, select the Provider Specific page for the LDAP authentication provider you are configuring Security Realms myrealm Providers Authentication your LDAP Authentication provider Provider Specific, and specify 100 in the field labeled Connection Pool Size . 2. Enable and enlarge the cache used with the LDAP server by completing the following steps in the WebLogic Server Administration Console: a. Select the Provider Specific page for the LDAP Authentication provider Security Realms myrealm Providers Authentication your LDAP Authentication provider Provider Specific.

b. Scroll towards the bottom and make sure that Cache Enabled is checked.

c. In the field labeled Cache Size, specify a value of 3200 KB.

d. In the field labeled Cache TTL, specify a time-to-live value that matches the

Group Hierarchy Cache TTL value see Section 5.4.10.1, Optimizing the Group Membership Caches . A value of 6000 is recommended. e. Set the results timeout value for the LDAP server. On the current Provider Specific configuration page, specify a value of 1000 ms in the field labeled Results Time Limit . 3. Restart WebLogic Server for the changes to take effect.

5.4.10.3 Configuring Dynamic Groups in the iPlanet Authentication Provider to Improve Performance

Dynamic groups do not list the names of their members. Instead, the membership of the dynamic group is constructed by matching user attributes. Because group