Specifying that members of a group member cache are retrieved from the database

Use the group-member-cache-source setting in the appropriate 100Custom.xml file in your topology to specify that members of a group are retrieved from the IBM® Business Automation Workflow database only, and not from a user registry, for example LDAP. This setting significantly increases the speed at which group members are loaded into the cache and reduces the number of cache reloads.

About this task

The configuration setting improves the performance of process application deployment, changes to group memberships in the Process Admin Console, and internal group membership lookups, for example, for assignment of roles. It also minimizes the scenarios where an LDAP connection timeout can occur.

Procedure

Include the following group-member-cache-source setting in the appropriate 100Custom.xml file in your topology (see the topic Location of 100Custom configuration files for its location) to specify that the members of a group are determined from the database only.

<properties>
     <server merge="mergeChildren">                 
          <group-member-cache-source merge="replace">DB</group-member-cache-source>            
     </server>
</properties>

Results

The configuration setting does not affect the login behavior. Group memberships will still be refreshed when a user logs in to an application, and the data will be retrieved from the database and all user registries. Additionally, group membership refreshes at login time can be optimized by using the user-group-membership-sync-cache-expiration configuration property. For more information, see Optimizing the login time for web applications.

Depending on the user activity in an environment, it might be possible that the group memberships in the database are not as up-to-date as required when you use the group-member-cache-source setting. To help resolve this problem, there are scripts independent of the user login and group-member-cache-source setting that can be used to update the group memberships. However, depending on the number and complexity of group memberships, these scripts can run for a long time and must be evaluated carefully. For more information, see Synchronizing group membership by groups.