PM56585: MOD_AUTHNZ_LDAP CAN GENERATE MANY UNNECESSARY LDAP QUERIES WHILE PROCESSING "REQUIRE GROUP ..."

Fixes are available

APAR status

Closed as program error.

Error description

IBM HTTP Server Users may see delays and high
CPU when using mod_ldap/mod_authnz_ldap with
multiple-values for AuthLDAPGroupAttribute
(default) when large, flat groups are searched.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  IBM HTTP Server users with "Require ldap-   *
*                  group" configured that experience           *
*                  occasional                                  *
*                  delays and high CPU searching flat (non-    *
*                  nested) groups.                             *
****************************************************************
* PROBLEM DESCRIPTION: If the required user cannot be found    *
*                      with the first value of                 *
*                      AuthLDAPGroupAttribute in the required  *
*                      group, IHS will generate 1 query per    *
*                      group member to see if any of them are  *
*                      actually sub-groups to be searched.     *
*                      This is inefficient since remaining     *
*                      AuthLDAPGroupAttribute values could be  *
*                      very quickly checked before looking for *
*                      nested/recurisv subgroups.              *
****************************************************************
* RECOMMENDATION:  Apply cumulative maintenance including this *
*                  fix if there are occasional (first access   *
*                  of                                          *
*                  a group) spikes in CPU or response time     *
*                  with                                        *
*                  LDAP authorization.                         *
****************************************************************
For a large, flat, group the potentially unnecessary lookups are
LDAP searches with each group member with a filter of
objectClass=$AuthLDAPSubGroupClass.
These lookups are cached, but effect worst-case time/CPU the
first time a group is accessed.

Problem conclusion

IBM HTTP Server was updated to exhaust all flat
AuthLDAPGroupAttribute checks (fast) before looking for
matches in sub-groups (slow until cached)

This fix is targeted for IBM HTTP Server fixpacks:
 - 7.0.0.23
 - 8.0.0.4

Temporary fix

Comments

APAR Information

APAR number
PM56585
Reported component name
IBM HTTP SERVER
Reported component ID
5724J0801
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2012-01-24
Closed date
2012-02-22
Last modified date
2012-02-22

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
IBM HTTP SERVER
Fixed component ID
5724J0801

Applicable component levels

R700 PSY
UP
R800 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
07 September 2022

Tips

PM56585: MOD_AUTHNZ_LDAP CAN GENERATE MANY UNNECESSARY LDAP QUERIES WHILE PROCESSING "REQUIRE GROUP ..."

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

R800 PSY

Document Information

Share your feedback

Need support?