IBM WebSphere V5.0 Security - CGISecurity

9.3 Performance considerations
From a performance point of view, there are few things to consider when
designing a secure solution.
The authorization process brings an additional load to the application server. In a
distributed environment, the authorization server should be put onto a separate
machine in order to offload application processing. The following three settings
can help to fine-tune the security related configurations to enhance performance.
► Security Cache Timeout
This is set to indicate how long WebSphere should cache information related
to permission and security credentials. When the cache timeout expires, all
cached information becomes invalid. Subsequent requests for the information
result in a database lookup. Sometimes, acquiring the information requires
invoking an LDAP-bind or native authentication, both of which are relatively
costly operations in terms of performance.
► HTTP Session timeout
This parameter specifies how long a session will be considered active when it
is unused. After the timeout, the session expires and another session object
will need to be created. With high volume Web sites, this may influence the
performance of the server.
► Registry and database performance
Databases and registries that WebSphere Application Server is using have
an influence on WebSphere Application Server performance. This is
especially true in distributed environments when the Authorization process
uses an LDAP server; you have to consider tuning the LDAP database and
the LDAP server for performance before starting to tune WebSphere.
9.4 Authentication summary
The following diagram is a summary of the authentication mechanisms for the
different kind of clients (the term clients here is used in the most general way).
230 IBM WebSphere V5.0 Security Handbook