From: Eric Covener <covener@apache.org>
Date: Mon, 23 Sep 2013 13:42:44 +0000 (+0000)
Subject: Merge r1525588 from trunk:
X-Git-Tag: 2.4.7~181
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f80bf4f6356b37c91141d40d60ec38c0521309a0;p=apache

Merge r1525588 from trunk:

add a note about sub-group searching and large groups.




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1525590 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/mod/mod_authnz_ldap.html.en b/docs/manual/mod/mod_authnz_ldap.html.en
index 71990521d9..54f426a3cd 100644
--- a/docs/manual/mod/mod_authnz_ldap.html.en
+++ b/docs/manual/mod/mod_authnz_ldap.html.en
@@ -1133,6 +1133,15 @@ evaluated before the user search is discontinued.</td></tr>
    <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
    section for a more detailed example.</p>
 
+   <div class="note"><h3>Nested groups performance</h3>
+   <p> When <code class="directive">AuthLDAPSubGroupAttribute</code> overlaps with
+   <code class="directive">AuthLDAPGroupAttribute</code> (as it does by default and
+   as required by common LDAP schemas), uncached searching for subgroups in 
+   large groups can be very slow. If you use large, non-nested groups, set 
+   <code class="directive">AuthLDAPMaxSubGroupDepth</code> to zero.</p>
+   </div>
+
+
 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthLDAPRemoteUserAttribute" id="AuthLDAPRemoteUserAttribute">AuthLDAPRemoteUserAttribute</a> <a name="authldapremoteuserattribute" id="authldapremoteuserattribute">Directive</a></h2>
diff --git a/docs/manual/mod/mod_authnz_ldap.xml b/docs/manual/mod/mod_authnz_ldap.xml
index 95ef0554e6..f011063e70 100644
--- a/docs/manual/mod/mod_authnz_ldap.xml
+++ b/docs/manual/mod/mod_authnz_ldap.xml
@@ -1090,6 +1090,15 @@ evaluated before the user search is discontinued.</description>
    level <code>X</code> specified by this directive.</p>
    <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
    section for a more detailed example.</p>
+
+   <note><title>Nested groups performance</title>
+   <p> When <directive>AuthLDAPSubGroupAttribute</directive> overlaps with
+   <directive>AuthLDAPGroupAttribute</directive> (as it does by default and
+   as required by common LDAP schemas), uncached searching for subgroups in 
+   large groups can be very slow. If you use large, non-nested groups, set 
+   <directive>AuthLDAPMaxSubGroupDepth</directive> to zero.</p>
+   </note>
+
 </usage>
 </directivesynopsis>