<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
On 05/22/2018 07:36 PM, Keith Hazelton wrote:<br>
</div>
<blockquote type="cite"
cite="mid:BLUPR06MB1747AB8E980B316C0DDA60FBF4940@BLUPR06MB1747.namprd06.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I’d like to see midPoint/OpenLDAP
experience-based reactions to this comment I saw just now:
“OpenLDAP has issues with large groups. Large groups over
25-30k and you will have issues with group updates taking
about 6 seconds for each change.”<o:p></o:p></p>
</div>
</blockquote>
<br>
MidPoint has som optimizations already implemented. E.g. you can
mark "members" attribute with fetchStrategy=minimal, so midPoint
will avoid fetching that attribute unless it is absolutely
necessary. And is you have memberof overlay then it is almost never
necessary. Because midPoint is based on relative change model, i.e.
it deals with adding/removing values and it should be able to
survive without fetching full values. To be completely precise, this
is only partially true for normal attributes. We sometimes need all
values for normal attributes (e.g. reconciliation). But I'm quite
sure that the "relativity approach" works for entitlement
association attributes such as "members" attribute. As far as I
remember now we have tested that with Active Directory groups with
thousands of members. But I think there was also some testing with
even larger LDAP groups (I'm not 100% sure though).<br>
<br>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>