Re: ACL performance again

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 08:39 AM 2002-01-04, Kurt D. Zeilenga wrote:
>At 08:08 AM 2002-01-04, Stephan Siano wrote:
>>I encountered performance problems with rather complex (group based) ACLs in 
>>conjunction with large objects (approximately 120 attributes per object).
>>
>>The server returned only 6.5 objects per second for complex (attribute 
>>dependant, group based) ACLs, about 50 objects per second for simpler 
>>(attribute independent, group based) ACLs and about 140 objects per second 
>>without any ACL (defaultaccess read).
>>
>>Looking into the code (and switching on acl debugging) it showed that the 
>>wohle ACL is parsed and evaluated once for each attribute and once for each 
>>value (that means twice for a single-valued attribute).
>>
>>Why is it necessary to evaluate the ACLs for each value?
>
>Because OpenLDAP ACM has attribute value granularity.

I should clarify:   For the most part OpenLDAP ACM granularity
is attribute level.  But, due to certain directives, the
granularity must be treated as if it where value granularity.
If these directives are not in use, then the granularity is
attribute level.

Kurt