DN cache

Edit online

The Distinguished Name (DN) cache is an internal mechanism that stores DNs and their associated Entry IDs (EIDs) during system operations. It serves as the primary source for verifying DN existence for all read and update operations.

When the LDAP server receives a request, it first searches for the DN in the cache. If the DN is not found, the server queries the database to get the matching EID corresponding to the requested DN. After retrieving the EID, both the DN and EID are added to the DN cache. This mechanism ensures operational consistency across the server by preventing simultaneous execution of conflicting actions.

During periods of high system load, DN cache lookups may contribute to delays in operation response times. To enhance lookup performance, the LDAP server provides tunable parameters through environment variables.

SLAPD_HASH_BUCKETS=<#CPU * 8>
  • Purpose: Sets the number of hash buckets in the DN cache
  • Recommended value: Number of CPUs multiplied by 8
  • Default: If not set or configured incorrectly it is set to <#CPU * 8>
idsldapmodify -h host -p port -D adminDN -w adminPW
dn: cn=Front End, cn=configuration
changetype: modify
add: ibm-slapdSetEnv
ibm-slapdSetEnv: SLAPD_HASH_BUCKETS=192
IBMSLAPD_SELECT_QUERY_USE_DN_ONLY=(TRUE/FALSE)
  • Purpose: Enables select query optimization using DN value to use the existing index
  • Recommended value: TRUE
  • Default: TRUE (Uses select query which includes both DN columns) 
idsldapmodify -h host -p port -D adminDN -w adminPW
dn: cn=Front End, cn=configuration
changetype: modify
add: ibm-slapdSetEnv
ibm-slapdSetEnv: IBMSLAPD_SELECT_QUERY_USE_DN_ONLY=TRUE
IBMSLAPD_PWDPOL_GROUP_PROCESSING=(minimal/parameter/literal)
  • Purpose: Optimizes password policy-related queries that use objectclass
  • Value:
    • parameter: Uses the legacy select query with objectclass='parameter marker'
    • minimal: Excludes the objectclass reference in the select statement
    • literal: Uses the literal values of objectclass in the select query
  • Recommended value: If the environment variable is unset, invalid, or set to 'literal' (case-insensitive), the select query uses literal objectclass values.
idsldapmodify -h host -p port -D adminDN -w adminPW
dn: cn=Front End, cn=configuration
changetype: modify
add: ibm-slapdSetEnv
ibm-slapdSetEnv: IBMSLAPD_PWDPOL_GROUP_PROCESSING=minimal
SLAPD_BROADCAST_DN_CACHE=(0/1)
  • Purpose: Controls multithreading level optimization
    • 1: uses the broadcasting mechanism. This value reflects legacy behavior.
    • 0: uses the signaling mechanism
  • Recommended value: 0, uses the signaling mechanism
  • Default: 0, use signaling mechanism
idsldapmodify -h host -p port -D adminDN -w adminPW
dn: cn=Front End, cn=configuration
changetype: modify
add: ibm-slapdSetEnv
ibm-slapdSetEnv: SLAPD_BROADCAST_DN_CACHE=0