Best Practices for Working with Security Groups Performance Considerations

5-36 Oracle Fusion Middleware System Administrators Guide for Oracle Content Server

5.4.1.1 Best Practices for Working with Security Groups

Keep these considerations in mind when you define security groups: ■ Define security groups before anyone checks in files that must be secure. ■ The number of security groups should be kept at a minimum to provide optimum search performance and user administration performance. If your security model requires more than 50 security classifications, you should enable accounts and use them to control user permissions. This number varies depending on Search Performance and User Admin Performance . ■ Put all files that share the same access into one security group. ■ Set up a logical naming convention for your security groups. For example, use department names if you are setting up an intranet, and use levels of security internal, classified, and so forth if you are setting up an extranet. For example, Figure 5–1 shows three defined security groups Public, HRDocs, and EngDocs. They are associated with five users assigned different roles Admin, Contributor, Guest, Sysadmin, Subadmin and specific sets of permissions Read, Write, Delete, Admin. Figure 5–1 Example of Defining Security Groups

5.4.1.2 Performance Considerations

Your user access choices for security groups and roles can affect the following system performance areas: ■ Search Performance ■ User Admin Performance

5.4.1.2.1 Search Performance Search performance is affected by the number of security

groups a user has permission to access. To return only content that a user has permission to view, the database WHERE clause includes a list of security groups. The WHERE clause either includes all of the security groups the user has permission to access, or it includes all of the security groups the user does not have permission to access. Which approach is taken depends on whether the user has permission to more than 50 or fewer than 50 of the defined security groups. For example, if 100 security groups are defined, and a user has permission to 10 security groups, the 10 security groups will be included in the WHERE clause. In contrast, for a user with permission to access 90 security groups, the WHERE clause includes the 10 security groups the user does not have permission to access. Managing Security and User Access 5-37 Therefore, if a user has permission to almost 50 of the security groups, the search performance is less efficient. If a user has permission to all or none of the security groups, the search performance is more efficient.

5.4.1.2.2 User Admin Performance The total number of security groups multiplied by the

total number of roles determines the number of rows in the RoleDefinition database table, which affects the performance of the User Admin application for operations involving local users. To determine the approximate time required to perform an operation in the User Admin application, such as adding a security group or changing permission for a role, use the following formula: of security groups X of roles 1000 = Time of operation in seconds For example, using a PC with a 400 MHz processor, 128 MB of RAM, it took approximately 10 seconds to add a security group, or role, or both, using the User Admin application when the RoleDefinition table has 10,000 rows. As the number of security groups increases, administration performance is affected more than consumer search performance.

5.4.2 Managing Oracle Content Server Groups