Cache Plug-in Memory Management

Oracle Identity Federation Performance Tuning 24-3 waiting too long for an error when the server is not responding, Oracle Identity Federation sets a read timeout property on the LDAP connection. If the LDAP server does not respond before the read timeout period, an error is generated. Oracle Identity Federation closes the connection, open a new one and re-issue the LDAP command. See Configuring the LDAP Read Timeout Setting in Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation. ■ Setting the High Availability HA LDAP Flag. When integrated with LDAP Servers that are deployed in HA mode, Oracle Identity Federation must configured to indicate that the LDAP Servers are in HA mode. See Configuring High Availability LDAP Servers in Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation.

24.2.3 Federation Data Store Settings

When using Oracle Internet Directory as the Federation Data Store, Oracle Identity Federation creates, locates, updates and deletes federation records containing Account Linking Information. Oracle Identity Federation uses specific queries when interacting with Oracle Internet Directory, and the performance can be improved by creating filters in Oracle Internet Directory. If Oracle Internet Directory is used as the Federation Data Store, it is possible to tune the LDAP Server to improve the performance of the lookup operations. Oracle Identity Federation server can be configured to use a Federation Store to persist Federated Identities records. The Federation server uses this store to: ■ Lookup a federation record through different queries ■ Create a federation record ■ Delete a federation In addition to the Oracle Identity Federation-related orclinmemfiltprocess filter objectclass=orclfeduserinfo, which is included by default, some Oracle Identity Federation environments might benefit from additional filters with the following formats: orclfedserverid=local_oif_server_id orclfedproviderid=providerid_of_remote_server orclfedfederationtype=n where orclfedserverid denotes the Oracle Identity Federation server that is making the query, orclfedproviderid is the identifier of a remote SAML server, and orclfedfederationtype is 1 or 3. Use 1 as the value for orclfedfederationtype when Oracle Identity Federation is an Identity Provider and the remote provider is a Service Provider. Use 3 when Oracle Identity Federation is a Service Provider and the remote provider is an Identity Provider. A deployment can be configured to work with many remote SAML servers, so there can be several orclfedproviderid filters and more than one orclfedfederationtype filter. For example: orclfedserverid=my_oif_server orclfedproviderid=http:server.example.com:7499fedidp 24-4 Oracle Fusion Middleware Performance and Tuning Guide orclfedproviderid=http:server2.example.com:7492fedidp orclfedfederationtype=1 orclfedfederationtype=3

24.3 Database Tuning

This section provides configuration settings that can be used to tune the database. See Additional RDBMS Configuration in Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation.

24.3.1 Data Sources

Oracle Identity Federation uses a Java EE data source to interact with a database for various operations, such as: ■ Locating a user record in the User Data Store ■ Retrieving attributes from a user record in the User Data Store ■ Locating, creating, or deleting an Oracle Identity Federation record from the Federation Data Store ■ Locating, creating, or deleting an Oracle Identity Federation transient record from the Session or Message Data Store. A transient record can be a user session, an artifact record, or federation protocol or session state. When creating a data source in the WebLogic Administration Console that can be used by Oracle Identity Federation, the maximum and minimum connection settings should be tuned for better performance. Consult your use case scenarios to determine what the connections settings should be to improve performance in your application.

24.3.2 RDBMS Session Cache

When Oracle Identity Federation is integrated with RDBMS for its Session Data Store, the server uses a caching mechanism to improve performance at run time. This enables the server to keep a reference to recently used session objects in memory to avoid read access to the database. To optimize RDBMS session caching, configure the following: ■ Number of session objects kept in memory at a given time ■ Length of time a specific session object is kept in memory See Configuring RDBMS Session Cache in Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation.

24.3.3 RDBMS Compression

To decrease the amount of data to be stored in an RDBMS, Oracle Identity Federation provides the capability to compress the data before storing it to the database.There are three kinds of data that can be compressed: Note: if Oracle Identity Federation is in High Availability HA mode with a load balancer, sticky sessions must be enabled to ensure that the cache is always reflecting accurate data.