The server support virtual attributes in search requests. virtual attributes are supported in the search filter and also in the returned attributes. Virtual attributes are implemented via a list of registered service providers. This mechanism creates performance issues both in terms of CPU consumption and search throughput (contention). The reason is that the mechanism itself is complex and expensive. By default the server support virtual attributes and so reduce its throughput. This document propose a way to enable the support of virtual attribute only when it is necessary
The feature change the default value of the configuration attribute nsslapd-ignore-virtual-attrs to on. At startup, if the value is off (set by the DS admin) the server does nothing. If the value is on and if it exists virtual attribute definitions then the value is set to off
Virtual attributes are implemented via private registering fonction slapi_vattrspi_regattr and slapi_vattrspi_register. So the only supported virtual attributes use the COS or ROLES plugins.
The Roles plugin is enabled by default and registers a nsRole virtual attribute in its startup callback.
The values of the virtual attribute nsRole are taken from role definitions that are ldapsubentry with the objectclass nsRoleDefinition. So even if nsRole attribute is systematically registered, it has no impact unless it exists nsRoleDefinition entries.
The Cos plugin is enabled by default. It registers virtual attributes (cosAttribute) that are defined in cosSuperDefinition entries.
The server will be configured to ignore by default virtual attributes (nsslapd-ignore-virtual-attrs: on).
If nsslapd-ignore-virtual-attrs: off (setting by the DS admin) do nothing, so do lookup for virtual attributes.
In slapi_vattrspi_regattr, if nsslapd-ignore-virtual-attrs: on and there is a registered attribute different than nsRole then toggle nsslapd-ignore-virtual-attrs: off. It logs the following message
INFO - slapi_vattrspi_regattr - Because employeeType is a new registered virtual attribute , nsslapd-ignore-virtual-attrs set to 'off'
| Few second after startup (3sec), the server spawn a virtual-attribute check thread. That thread will do an internal search with the following filter *”(&(objectclass=ldapsubentry)( | (objectclass=nsRoleDefinition)(objectclass=cosSuperDefinition)))”. If it retrieves one or more entries, then it toggles *nsslapd-ignore-virtual-attrs: off. Before doing the internal search, the thread exits if nsslapd-ignore-virtual-attrs: off. |
INFO - vattr_check_thread - Found a role/cos definition in cn=FILTERROLEENGROLE,o=acivattr,dc=example,dc=com
INFO - vattr_check_thread - Because of virtual attribute definition nsslapd-ignore-virtual-attrs set to 'off'
Once the server is startup, new virtual attributes can be register. COS definition lead to call to slapi_vattrspi_regattr and the toggle of nsslapd-ignore-virtual-attrs is managed there. Role definition already have the nsRole virtual attribute registered, so it needs to be managed in roles_cache_trigger_update_role. When a new role definition is added the following message is logged in the error logs
INFO - roles_cache_trigger_update_role - Because of virtual attribute definition (role) then nsslapd-ignore-virtual-attrs set to 'off'
Install the instance with sample entries, then add 20 entries like
dn: uid=demo[1..20]_user,ou=people,dc=example,dc=com
objectClass: top
objectClass: nsPerson
objectClass: nsAccount
objectClass: nsOrgPerson
objectClass: posixAccount
uid: demo[1..20]_user
cn: Demo User
displayName: Demo User
legalName: Demo User Name
uidNumber: 99998
gidNumber: 99998
homeDirectory: /var/empty
loginShell: /bin/false
Out of the box virtual attributes are disabled (default value nsslapd-ignore-virtual-attrs: on):
Run the following commands
searchrate -h localhost -p 389 –bindDN “cn=directory manager” –bindPassword … –baseDN “dc=example,dc=com” –scope sub –filter “(&(uidNumber=*)(gidNumber=99998)(displayName=Demo User)(legalName=Demo User Name)(homeDirectory=*)(cn=Demo User))” –numThreads *
Enable support of virtual attribute
Run the following commands
searchrate -h localhost -p 389 –bindDN “cn=directory manager” –bindPassword … –baseDN “dc=example,dc=com” –scope sub –filter “(&(uidNumber=*)(gidNumber=99998)(displayName=Demo User)(legalName=Demo User Name)(homeDirectory=*)(cn=Demo User))” –numThreads *