The LDAP_DESC(AEID, DEID) index

Edit online

You can create the LDAP_DESC(AEID,DEID) index to tune and improve the performance directory server for subtree operations.

When you create the LDAP_DESC(AEID,DEID) index, you must stop the directory server instance. You can run create index without stopping the directory server instance. If you use the server when you run indexing on the server, it might result in timeouts.

You must create the (AEID,DEID) index on the DB2® LDAP_DESC table. The following examples show how indexing can improve performance:

  • Running a subtree search with an objectclass=* filter when 100000 entries exist in the directory server.
  • Setting an ACL on a small subtree when millions of entries exist in the directory server. For example, running the ldapmodify command to set the ACL.

Propagating ACLs to the child entries of a large subtree is slow regardless of the existence of the index. Without the LDAP_DESC(AEID,DEID) index, all subtree searches with the objectclass=* filter are slow on a large directory server, even if the subtree that you are searching is small.

When you design an LDAP search, you must consider the order in which the subtree criterion is used in evaluating the response. The subtree criterion is used last. Subtree searches specifying a commonly used object class values on a small subtree of a large directory are slow even if the LDAP_DESC(AEID,DEID) exists. For best performance, you must not use searches that specify a commonly used object class value.

If the directory server has many existing entries, the index creation takes time. To check for the existence of the LDAP_DESC(AEID,DEID) index, run the following command: 

db2 connect to ldapdb2
db2 describe indexes for table ldap_desc show detail

If the output does not include the +DEID+AEID keyword, then the index does not exist.

To create the LDAP_DESC(AEID,DEID) index, run the following command:

db2 connect to ldapdb2
db2 "create index LDAP_DESC_DEID on LDAP_DESC(AEID,DEID)"

You can remove the LDAP_DESC(AEID,DEID) index by the running the following command: 

db2 connect to ldapdb2
db2 drop index IDSLDAP.LDAP_DESC_DEID