This file is generated from xml source: DO NOT EDIT
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
--><title>mod_ldap - Apache HTTP Server</title><link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /><link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /><link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link href="../images/favicon.ico" rel="shortcut icon" /></head><body><div id="page-header"><p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p><p class="apache">Apache HTTP Server Version 2.0</p><img alt="" src="../images/feather.gif" /></div><div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div><div id="path"><a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs-project/">Documentation</a> > <a href="../">Version 2.0</a> > <a href="./">Modules</a></div><div id="page-content"><div id="preamble"><h1>Apache Module mod_ldap</h1><table class="module"><tr><th><a href="module-dict.html#Description">Description:
- </a></th><td>LDAP connection pooling and result caching
-
services for use by other LDAP modules</td></tr><tr><th><a href="module-dict.html#Status">Status:
+ </a></th><td>LDAP connection pooling and result caching services for use
+by other LDAP modules</td></tr><tr><th><a href="module-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:
</a></th><td>ldap_module</td></tr><tr><th><a href="module-dict.html#SourceFile">Source File:
</a></th><td>util_ldap.c</td></tr><tr><th><a href="module-dict.html#Compatibility">Compatibility:
<li><img alt="" src="../images/down.gif" /> <a href="#ldapopcachettl">LDAPOpCacheTTL</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#ldapsharedcachesize">LDAPSharedCacheSize</a></li>
</ul><h3>Topics</h3><ul id="topics"><li><img alt="" src="../images/down.gif" /> <a href="#exampleconfig">Example Configuration</a></li><li><img alt="" src="../images/down.gif" /> <a href="#pool">LDAP Connection Pool</a></li><li><img alt="" src="../images/down.gif" /> <a href="#cache">LDAP Cache</a></li></ul></div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="section"><h2><a name="exampleconfig" id="exampleconfig">Example Configuration</a></h2>
-
-<p>The following is an example configuration that uses
-<code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> to increase the performance of HTTP Basic
-authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code>.</p>
-
-<div class="example"><pre>
-# Enable the LDAP connection pool and shared memory cache. Enable the
-# LDAP cache status handler. Requires that mod_ldap and mod_auth_ldap
-# be loaded. Change the "yourdomain.example.com" to match your domain.
-
- LDAPSharedCacheSize 200000
- LDAPCacheEntries 1024
- LDAPCacheTTL 600
- LDAPOpCacheEntries 1024
- LDAPOpCacheTTL 600
-
- <Location /ldap-status>
- SetHandler ldap-status
- Order deny,allow
- Deny from all
- Allow from yourdomain.example.com
- AuthLDAPEnabled on
- AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one
- AuthLDAPAuthoritative on
- require valid-user
- </Location>
-</pre></div>
+ <p>The following is an example configuration that uses
+ <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> to increase the performance of HTTP Basic
+ authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code>.</p>
+
+ <div class="example"><p><code>
+ # Enable the LDAP connection pool and shared<br />
+ # memory cache. Enable the LDAP cache status<br />
+ # handler. Requires that mod_ldap and mod_auth_ldap<br />
+ # be loaded. Change the "yourdomain.example.com" to<br />
+ # match your domain.<br />
+ <br />
+ LDAPSharedCacheSize 200000<br />
+ LDAPCacheEntries 1024<br />
+ LDAPCacheTTL 600<br />
+ LDAPOpCacheEntries 1024<br />
+ LDAPOpCacheTTL 600<br />
+ <br />
+ <Location /ldap-status><br />
+ <span class="indent">
+ SetHandler ldap-status<br />
+ Order deny,allow<br />
+ Deny from all<br />
+ Allow from yourdomain.example.com<br />
+ AuthLDAPEnabled on<br />
+ AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one<br />
+ AuthLDAPAuthoritative on<br />
+ require valid-user<br />
+ </span>
+ </Location>
+ </code></p></div>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="section"><h2><a name="pool" id="pool">LDAP Connection Pool</a></h2>
<p>LDAP connections are pooled from request to request. This
with mod_auth_ldap. In addition, the load on the LDAP server
will be significantly decreased.</p>
- <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> supports two types of LDAP caching during the
- search/bind phase with a <em>search/bind cache</em> and
+ <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> supports two types of LDAP caching during
+ the search/bind phase with a <em>search/bind cache</em> and
during the compare phase with two <em>operation
caches</em>. Each LDAP URL that is used by the server has
its own set of these three caches.</p>
-<h3><a name="search-bind" id="search-bind">The Search/Bind Cache</a></h3>
-
- <p>The process of doing a search and then a bind is the
- most time-consuming aspect of LDAP operation, especially if
- the directory is large. The search/bind cache is used to
- cache all searches that resulted in successful binds.
- Negative results (i.e., unsuccessful searches, or searches
- that did not result in a successful bind) are not cached.
- The rationale behind this decision is that connections with
- invalid credentials are only a tiny percentage of the total
- number of connections, so by not caching invalid
- credentials, the size of the cache is reduced.</p>
-
- <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> stores the username, the DN
- retrieved, the password used to bind, and the time of the bind
- in the cache. Whenever a new connection is initiated with the
- same username, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> compares the password
- of the new connection with the password in the cache. If the
- passwords match, and if the cached entry is not too old,
- <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> bypasses the search/bind phase.</p>
-
- <p>The search and bind cache is controlled with the <code class="directive"><a href="#ldapcacheentries">LDAPCacheEntries</a></code> and <code class="directive"><a href="#ldapcachettl">LDAPCacheTTL</a></code> directives.</p>
-
-
-<h3><a name="opcaches" id="opcaches">Operation Caches</a></h3>
-
- <p>During attribute and distinguished name comparison
- functions, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> uses two operation caches
- to cache the compare operations. The first compare cache is
- used to cache the results of compares done to test for LDAP
- group membership. The second compare cache is used to cache
- the results of comparisons done between distinguished
- names.</p>
-
- <p>The behavior of both of these caches is controlled with
- the <code class="directive"><a href="#ldapopcacheentries">LDAPOpCacheEntries</a></code>
- and <code class="directive"><a href="#ldapopcachettl">LDAPOpCacheTTL</a></code>
- directives.</p>
-
-
-<h3><a name="monitoring" id="monitoring">Monitoring the Cache</a></h3>
-
- <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> has a content handler that allows
- administrators to monitor the cache performance. The name of
- the content handler is <code>ldap-status</code>, so the
- following directives could be used to access the
- <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache information:</p>
-<div class="example"><pre>
-<Location /server/cache-info >
- SetHandler ldap-status
-</Location>
-</pre></div>
-
- <p>By fetching the URL
- <code>http://servername/cache-info</code>, the administrator
- can get a status report of every cache that is used by
- <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache. Note that if Apache does not
- support shared memory, then each <code>httpd</code> instance has its
- own cache, so reloading the URL will result in different
- information each time, depending on which <code>httpd</code>
- instance processes the request.</p>
-
+ <h3><a name="search-bind" id="search-bind">The Search/Bind Cache</a></h3>
+ <p>The process of doing a search and then a bind is the
+ most time-consuming aspect of LDAP operation, especially if
+ the directory is large. The search/bind cache is used to
+ cache all searches that resulted in successful binds.
+ Negative results (<em>i.e.</em>, unsuccessful searches, or searches
+ that did not result in a successful bind) are not cached.
+ The rationale behind this decision is that connections with
+ invalid credentials are only a tiny percentage of the total
+ number of connections, so by not caching invalid
+ credentials, the size of the cache is reduced.</p>
+
+ <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> stores the username, the DN
+ retrieved, the password used to bind, and the time of the bind
+ in the cache. Whenever a new connection is initiated with the
+ same username, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> compares the password
+ of the new connection with the password in the cache. If the
+ passwords match, and if the cached entry is not too old,
+ <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> bypasses the search/bind phase.</p>
+
+ <p>The search and bind cache is controlled with the <code class="directive"><a href="#ldapcacheentries">LDAPCacheEntries</a></code> and <code class="directive"><a href="#ldapcachettl">LDAPCacheTTL</a></code> directives.</p>
+
+
+ <h3><a name="opcaches" id="opcaches">Operation Caches</a></h3>
+ <p>During attribute and distinguished name comparison
+ functions, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> uses two operation caches
+ to cache the compare operations. The first compare cache is
+ used to cache the results of compares done to test for LDAP
+ group membership. The second compare cache is used to cache
+ the results of comparisons done between distinguished
+ names.</p>
+
+ <p>The behavior of both of these caches is controlled with
+ the <code class="directive"><a href="#ldapopcacheentries">LDAPOpCacheEntries</a></code>
+ and <code class="directive"><a href="#ldapopcachettl">LDAPOpCacheTTL</a></code>
+ directives.</p>
+
+
+ <h3><a name="monitoring" id="monitoring">Monitoring the Cache</a></h3>
+ <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> has a content handler that allows
+ administrators to monitor the cache performance. The name of
+ the content handler is <code>ldap-status</code>, so the
+ following directives could be used to access the
+ <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache information:</p>
+
+ <div class="example"><p><code>
+ <Location /server/cache-info><br />
+ <span class="indent">
+ SetHandler ldap-status<br />
+ </span>
+ </Location>
+ </code></p></div>
+
+ <p>By fetching the URL <code>http://servername/cache-info</code>,
+ the administrator can get a status report of every cache that is used
+ by <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache. Note that if Apache does not
+ support shared memory, then each <code>httpd</code> instance has its
+ own cache, so reloading the URL will result in different
+ information each time, depending on which <code>httpd</code>
+ instance processes the request.</p>
+
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPCacheEntries" id="LDAPCacheEntries">LDAPCacheEntries</a> <a name="ldapcacheentries" id="ldapcacheentries">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description:
</a></th><td>Maximum number of entires in the primary LDAP cache</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax:
- </a></th><td><code>LDAPCacheEntries <
em>number</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
+ </a></th><td><code>LDAPCacheEntries <
var>number</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
</a></th><td><code>LDAPCacheEntries 1024</code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
</a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module:
searches.</p>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPCacheTTL" id="LDAPCacheTTL">LDAPCacheTTL</a> <a name="ldapcachettl" id="ldapcachettl">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description:
</a></th><td>Time that cached items remain valid</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax:
- </a></th><td><code>LDAPCacheTTL <
em>seconds</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
+ </a></th><td><code>LDAPCacheTTL <
var>seconds</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
</a></th><td><code>LDAPCacheTTL 600</code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
</a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module:
minutes).</p>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPCertDBPath" id="LDAPCertDBPath">LDAPCertDBPath</a> <a name="ldapcertdbpath" id="ldapcertdbpath">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description:
</a></th><td>Directory containing certificates for SSL support</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax:
- </a></th><td><code>LDAPCertDBPath <
em>directory-path</em></code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
+ </a></th><td><code>LDAPCertDBPath <
var>directory-path</var></code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
</a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module:
</a></th><td>mod_ldap</td></tr></table>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPOpCacheEntries" id="LDAPOpCacheEntries">LDAPOpCacheEntries</a> <a name="ldapopcacheentries" id="ldapopcacheentries">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description:
</a></th><td>Number of entries used to cache LDAP compare
operations</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax:
- </a></th><td><code>LDAPOpCacheEntries <
em>number</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
+ </a></th><td><code>LDAPOpCacheEntries <
var>number</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
</a></th><td><code>LDAPOpCacheEntries 1024</code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
</a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module:
will use to cache LDAP compare operations. The default is 1024
entries. Setting it to 0 disables operation caching.</p>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPOpCacheTTL" id="LDAPOpCacheTTL">LDAPOpCacheTTL</a> <a name="ldapopcachettl" id="ldapopcachettl">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description:
- </a></th><td>Time that entries in the operation cache remain
+ </a></th><td>Time that entries in the operation cache remain
valid</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax:
- </a></th><td><code>LDAPOpCacheTTL <
em>seconds</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
+ </a></th><td><code>LDAPOpCacheTTL <
var>seconds</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
</a></th><td><code>LDAPOpCacheTTL 600</code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
</a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module:
operation cache remain valid. The default is 600 seconds.</p>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPSharedCacheSize" id="LDAPSharedCacheSize">LDAPSharedCacheSize</a> <a name="ldapsharedcachesize" id="ldapsharedcachesize">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description:
</a></th><td>Size in bytes of the shared-memory cache</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax:
- </a></th><td><code>LDAPSharedCacheSize <
em>bytes</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
+ </a></th><td><code>LDAPSharedCacheSize <
var>bytes</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default:
</a></th><td><code>LDAPSharedCacheSize 102400</code></td></tr><tr><th><a href="directive-dict.html#Context">Context:
</a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status:
</a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module:
<modulesynopsis>
<name>mod_ldap</name>
-<description>LDAP connection pooling and result caching
-services for use by other LDAP modules</description>
+<description>LDAP connection pooling and result caching services for use
+by other LDAP modules</description>
<status>Experimental</status>
<sourcefile>util_ldap.c</sourcefile>
<identifier>ldap_module</identifier>
</summary>
<section id="exampleconfig"><title>Example Configuration</title>
-
-<p>The following is an example configuration that uses
-<module>mod_ldap</module> to increase the performance of HTTP Basic
-authentication provided by <module>mod_auth_ldap</module>.</p>
-
-<example>
-<pre>
-# Enable the LDAP connection pool and shared memory cache. Enable the
-# LDAP cache status handler. Requires that mod_ldap and mod_auth_ldap
-# be loaded. Change the "yourdomain.example.com" to match your domain.
-
- LDAPSharedCacheSize 200000
- LDAPCacheEntries 1024
- LDAPCacheTTL 600
- LDAPOpCacheEntries 1024
- LDAPOpCacheTTL 600
-
- <Location /ldap-status>
- SetHandler ldap-status
- Order deny,allow
- Deny from all
- Allow from yourdomain.example.com
- AuthLDAPEnabled on
- AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one
- AuthLDAPAuthoritative on
- require valid-user
- </Location>
-</pre></example>
+ <p>The following is an example configuration that uses
+ <module>mod_ldap</module> to increase the performance of HTTP Basic
+ authentication provided by <module>mod_auth_ldap</module>.</p>
+
+ <example>
+ # Enable the LDAP connection pool and shared<br />
+ # memory cache. Enable the LDAP cache status<br />
+ # handler. Requires that mod_ldap and mod_auth_ldap<br />
+ # be loaded. Change the "yourdomain.example.com" to<br />
+ # match your domain.<br />
+ <br />
+ LDAPSharedCacheSize 200000<br />
+ LDAPCacheEntries 1024<br />
+ LDAPCacheTTL 600<br />
+ LDAPOpCacheEntries 1024<br />
+ LDAPOpCacheTTL 600<br />
+ <br />
+ <Location /ldap-status><br />
+ <indent>
+ SetHandler ldap-status<br />
+ Order deny,allow<br />
+ Deny from all<br />
+ Allow from yourdomain.example.com<br />
+ AuthLDAPEnabled on<br />
+ AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one<br />
+ AuthLDAPAuthoritative on<br />
+ require valid-user<br />
+ </indent>
+ </Location>
+ </example>
</section>
<section id="pool"><title>LDAP Connection Pool</title>
with mod_auth_ldap. In addition, the load on the LDAP server
will be significantly decreased.</p>
- <p><module>mod_ldap</module> supports two types of LDAP caching during the
- search/bind phase with a <em>search/bind cache</em> and
+ <p><module>mod_ldap</module> supports two types of LDAP caching during
+ the search/bind phase with a <em>search/bind cache</em> and
during the compare phase with two <em>operation
caches</em>. Each LDAP URL that is used by the server has
its own set of these three caches.</p>
-<section id="search-bind"><title>The Search/Bind Cache</title>
-
- <p>The process of doing a search and then a bind is the
- most time-consuming aspect of LDAP operation, especially if
- the directory is large. The search/bind cache is used to
- cache all searches that resulted in successful binds.
- Negative results (i.e., unsuccessful searches, or searches
- that did not result in a successful bind) are not cached.
- The rationale behind this decision is that connections with
- invalid credentials are only a tiny percentage of the total
- number of connections, so by not caching invalid
- credentials, the size of the cache is reduced.</p>
-
- <p><module>mod_ldap</module> stores the username, the DN
- retrieved, the password used to bind, and the time of the bind
- in the cache. Whenever a new connection is initiated with the
- same username, <module>mod_ldap</module> compares the password
- of the new connection with the password in the cache. If the
- passwords match, and if the cached entry is not too old,
- <module>mod_ldap</module> bypasses the search/bind phase.</p>
-
- <p>The search and bind cache is controlled with the <directive
- module="mod_ldap">LDAPCacheEntries</directive> and <directive
- module="mod_ldap">LDAPCacheTTL</directive> directives.</p>
-</section>
-
-<section id="opcaches"><title>Operation Caches</title>
-
- <p>During attribute and distinguished name comparison
- functions, <module>mod_ldap</module> uses two operation caches
- to cache the compare operations. The first compare cache is
- used to cache the results of compares done to test for LDAP
- group membership. The second compare cache is used to cache
- the results of comparisons done between distinguished
- names.</p>
-
- <p>The behavior of both of these caches is controlled with
- the <directive module="mod_ldap">LDAPOpCacheEntries</directive>
- and <directive module="mod_ldap">LDAPOpCacheTTL</directive>
- directives.</p>
-</section>
-
-<section id="monitoring"><title>Monitoring the Cache</title>
-
- <p><module>mod_ldap</module> has a content handler that allows
- administrators to monitor the cache performance. The name of
- the content handler is <code>ldap-status</code>, so the
- following directives could be used to access the
- <module>mod_ldap</module> cache information:</p>
-<example><pre>
-<Location /server/cache-info >
- SetHandler ldap-status
-</Location>
-</pre></example>
-
- <p>By fetching the URL
- <code>http://servername/cache-info</code>, the administrator
- can get a status report of every cache that is used by
- <module>mod_ldap</module> cache. Note that if Apache does not
- support shared memory, then each <code>httpd</code> instance has its
- own cache, so reloading the URL will result in different
- information each time, depending on which <code>httpd</code>
- instance processes the request.</p>
-</section>
+ <section id="search-bind"><title>The Search/Bind Cache</title>
+ <p>The process of doing a search and then a bind is the
+ most time-consuming aspect of LDAP operation, especially if
+ the directory is large. The search/bind cache is used to
+ cache all searches that resulted in successful binds.
+ Negative results (<em>i.e.</em>, unsuccessful searches, or searches
+ that did not result in a successful bind) are not cached.
+ The rationale behind this decision is that connections with
+ invalid credentials are only a tiny percentage of the total
+ number of connections, so by not caching invalid
+ credentials, the size of the cache is reduced.</p>
+
+ <p><module>mod_ldap</module> stores the username, the DN
+ retrieved, the password used to bind, and the time of the bind
+ in the cache. Whenever a new connection is initiated with the
+ same username, <module>mod_ldap</module> compares the password
+ of the new connection with the password in the cache. If the
+ passwords match, and if the cached entry is not too old,
+ <module>mod_ldap</module> bypasses the search/bind phase.</p>
+
+ <p>The search and bind cache is controlled with the <directive
+ module="mod_ldap">LDAPCacheEntries</directive> and <directive
+ module="mod_ldap">LDAPCacheTTL</directive> directives.</p>
+ </section>
+
+ <section id="opcaches"><title>Operation Caches</title>
+ <p>During attribute and distinguished name comparison
+ functions, <module>mod_ldap</module> uses two operation caches
+ to cache the compare operations. The first compare cache is
+ used to cache the results of compares done to test for LDAP
+ group membership. The second compare cache is used to cache
+ the results of comparisons done between distinguished
+ names.</p>
+
+ <p>The behavior of both of these caches is controlled with
+ the <directive module="mod_ldap">LDAPOpCacheEntries</directive>
+ and <directive module="mod_ldap">LDAPOpCacheTTL</directive>
+ directives.</p>
+ </section>
+
+ <section id="monitoring"><title>Monitoring the Cache</title>
+ <p><module>mod_ldap</module> has a content handler that allows
+ administrators to monitor the cache performance. The name of
+ the content handler is <code>ldap-status</code>, so the
+ following directives could be used to access the
+ <module>mod_ldap</module> cache information:</p>
+
+ <example>
+ <Location /server/cache-info><br />
+ <indent>
+ SetHandler ldap-status<br />
+ </indent>
+ </Location>
+ </example>
+
+ <p>By fetching the URL <code>http://servername/cache-info</code>,
+ the administrator can get a status report of every cache that is used
+ by <module>mod_ldap</module> cache. Note that if Apache does not
+ support shared memory, then each <code>httpd</code> instance has its
+ own cache, so reloading the URL will result in different
+ information each time, depending on which <code>httpd</code>
+ instance processes the request.</p>
+ </section>
</section>
<directivesynopsis>
<name>LDAPSharedCacheSize</name>
<description>Size in bytes of the shared-memory cache</description>
-<syntax>LDAPSharedCacheSize <em>bytes</em></syntax>
+<syntax>LDAPSharedCacheSize <var>bytes</var></syntax>
<default>LDAPSharedCacheSize 102400</default>
<contextlist><context>server config</context></contextlist>
<directivesynopsis>
<name>LDAPCacheEntries</name>
<description>Maximum number of entires in the primary LDAP cache</description>
-<syntax>LDAPCacheEntries <em>number</em></syntax>
+<syntax>LDAPCacheEntries <var>number</var></syntax>
<default>LDAPCacheEntries 1024</default>
<contextlist><context>server config</context></contextlist>
<directivesynopsis>
<name>LDAPCacheTTL</name>
<description>Time that cached items remain valid</description>
-<syntax>LDAPCacheTTL <em>seconds</em></syntax>
+<syntax>LDAPCacheTTL <var>seconds</var></syntax>
<default>LDAPCacheTTL 600</default>
<contextlist><context>server config</context></contextlist>
<name>LDAPOpCacheEntries</name>
<description>Number of entries used to cache LDAP compare
operations</description>
-<syntax>LDAPOpCacheEntries <em>number</em></syntax>
+<syntax>LDAPOpCacheEntries <var>number</var></syntax>
<default>LDAPOpCacheEntries 1024</default>
<contextlist><context>server config</context></contextlist>
<directivesynopsis>
<name>LDAPOpCacheTTL</name>
-<description>Time that entries in the operation cache remain
+<description>Time that entries in the operation cache remain
valid</description>
-<syntax>LDAPOpCacheTTL <em>seconds</em></syntax>
+<syntax>LDAPOpCacheTTL <var>seconds</var></syntax>
<default>LDAPOpCacheTTL 600</default>
<contextlist><context>server config</context></contextlist>
<directivesynopsis>
<name>LDAPCertDBPath</name>
<description>Directory containing certificates for SSL support</description>
-<syntax>LDAPCertDBPath <em>directory-path</em></syntax>
+<syntax>LDAPCertDBPath <var>directory-path</var></syntax>
<contextlist><context>server config</context></contextlist>
<usage>
projects / apache / commitdiff