Merge r1525588 from trunk:

add a note about sub-group searching and large groups.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1525590 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_authnz_ldap.html.en b/docs/manual/mod/mod_authnz_ldap.html.en
index 71990521d9561a825d72a23fb36a35495132c916..54f426a3cd17d9ed116c4f485ee60edd68913921 100644 (file)
--- a/docs/manual/mod/mod_authnz_ldap.html.en
+++ b/docs/manual/mod/mod_authnz_ldap.html.en
@@ -1133,6 +1133,15 @@ evaluated before the user search is discontinued.</td></tr>
    <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
    section for a more detailed example.</p>
 
+   <div class="note"><h3>Nested groups performance</h3>
+   <p> When <code class="directive">AuthLDAPSubGroupAttribute</code> overlaps with
+   <code class="directive">AuthLDAPGroupAttribute</code> (as it does by default and
+   as required by common LDAP schemas), uncached searching for subgroups in 
+   large groups can be very slow. If you use large, non-nested groups, set 
+   <code class="directive">AuthLDAPMaxSubGroupDepth</code> to zero.</p>
+   </div>
+
+
 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthLDAPRemoteUserAttribute" id="AuthLDAPRemoteUserAttribute">AuthLDAPRemoteUserAttribute</a> <a name="authldapremoteuserattribute" id="authldapremoteuserattribute">Directive</a></h2>

diff --git a/docs/manual/mod/mod_authnz_ldap.xml b/docs/manual/mod/mod_authnz_ldap.xml
index 95ef0554e666ac65f69b4ad79be56c166d2ae7f3..f011063e7064ef5c73826cc43cecdaea66bc928d 100644 (file)
--- a/docs/manual/mod/mod_authnz_ldap.xml
+++ b/docs/manual/mod/mod_authnz_ldap.xml
@@ -1090,6 +1090,15 @@ evaluated before the user search is discontinued.</description>
    level <code>X</code> specified by this directive.</p>
    <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
    section for a more detailed example.</p>
+
+   <note><title>Nested groups performance</title>
+   <p> When <directive>AuthLDAPSubGroupAttribute</directive> overlaps with
+   <directive>AuthLDAPGroupAttribute</directive> (as it does by default and
+   as required by common LDAP schemas), uncached searching for subgroups in 
+   large groups can be very slow. If you use large, non-nested groups, set 
+   <directive>AuthLDAPMaxSubGroupDepth</directive> to zero.</p>
+   </note>
+
 </usage>
 </directivesynopsis>