CA Identity Manager Implementation Guide - CA Technologies

User Store TuningUser Store TuningUser store tuning involves a number of steps, including the following:■■■Optimizing the structure of the user storeTuning underlying storesImplementing load balancing and replicationThese steps depend on the type of user store that you are using. For tuninginformation in these areas, see the documentation for the database or directorythat contains the user store.In addition to the general tuning considerations, the following tuningconsiderations are specific to CA Identity Manager:■Measure user store search performanceFor optimum performance, CA Identity Manager policy evaluation searchesshould complete within 10-20 milliseconds.To ensure that CA Identity Manager can consistently complete thesesearches in the recommended time, consider testing search performanceunder multiple load conditions.You can also use this measurement to determine when a user store reachesits physical limits and additional servers are required for load balancing.■Index attributesIndex each attribute that is used in a role policy or identity policy. Indexingattributes can provide significant performance improvements.Note: For information about indexing attributes, see the documentation forthe LDAP directory or relational database that contains the user store.■Cache LDAP BindsIn CA Identity Manager, all directory LDAP binds are executed by the proxyuser defined on the Identity Manager Directory object. For each connection,the same LDAP bind occurs for this same user repeatedly.If you are using an LDAP directory as a user store, configure the directory tocache LDAP binds (or sessions), if the directory supports it.■Enable user store cachesWhen CA Identity Manager evaluates the policy decisions for a user, thatinformation is stored in an authorization cache. When the cachedinformation expires, CA Identity Manager evaluates all policies for that useragain.To improve performance of user store searches in subsequent policy ruleevaluations, enable the user store to cache searched data, if your user storesupports it.Chapter 6: Optimizing Identity Manager 89