Question

How can slow performance be resolved when binding to a Huge LDAP repository?

Answer 1

LDAP slowness shows up as slow logins, slow task assignment, slow team resolution and slow user pickers. Fixes in the order that helps most:

1. Narrow the searches - in the federated repository set the LDAP base entry as deep as possible and configure user / group filters that use indexed attributes ((&(objectClass=user)(sAMAccountName=%v))); avoid objectClass=*; disable nested group resolution if you do not use it (the "Support for nested groups" option costs a query per level).
2. Cache - WebSphere federated repository caches (search results cache, attribute cache: the LDAP repository's Performance settings in Global security > Federated repositories: enable the attribute cache and the search results cache with a size that covers your active users); BPM's own user / group caches (the cache sizes in the <cache> section of 100Custom.xml, visible in Process Admin > Caches) sized for the number of users.
3. Team membership resolution - large groups (thousands of members) as team members are re-resolved on assignment; use team filter services that return a small set, or bind teams to smaller AD groups; keep the group refresh interval (Process Admin > User Management > group sync) at hours, not minutes.
4. Connection settings - the repository's LDAP connection pool settings, reuse connections, LDAPS with keep-alive, and a nearby domain controller / global catalog (port 3268 for multi-domain AD) instead of a far one.
5. Measure - enable the WIM trace briefly (com.ibm.ws.wim.*=fine) to see the queries and their duration; a thread dump during a slow login shows threads in com.ibm.ws.wim.adapter.ldap.
6. Synchronise instead of query - BAW keeps users and groups in its own tables (Process Admin > User Management > Synchronize, Operations REST users_sync); a nightly full sync plus the caches means most operations never touch LDAP.

# federated repository LDAP filters (AD) that use indexed attributes
User filter:  (&(sAMAccountName=%v)(objectcategory=user))
Group filter: (&(cn=%v)(objectcategory=group))
Group member id map: memberof:member
Search base: ou=Users,ou=Corp,dc=example,dc=com    (not the domain root)

References

• BAW documentation - configuring LDAP and tuning user / group lookups
• Operations REST API - users_sync / groups_sync