Red Hat DIRECTORY SERVER 8.0, Administration Manual, Page: 91 / 552

Advanced Feature: Tuning Database Link Performance
73
• All access controls based on the IP address or DNS domain of the client may not work since the
original domain of the client is lost during chaining. The remote server views the client application as
being at the same IP address and in the same DNS domain as the database link.
The following restrictions apply to the ACIs used with database links:
• ACIs must be located with any groups they use. If the groups are dynamic, all users in the group
must be located with the ACI and the group. If the group is static, it may refer to remote users.
• ACIs must be located with any role definitions they use and with any users intended to have those
roles.
• ACIs that refer to values of a user's entry (for example,
userattr
subject rules) will work if the user
is remote.
Though access controls are always evaluated on the remote server, they can also be evaluated on
both the server containing the database link and the remote server. This poses several limitations:
• During access control evaluation, contents of user entries are not necessarily available (for
example, if the access control is evaluated on the server containing the database link and the entry
is located on a remote server).
For performance reasons, clients cannot do remote inquiries and evaluate access controls.
• The database link does not necessarily have access to the entries being modified by the client
application.
When performing a modify operation, the database link does not have access to the full entry stored
on the remote server. If performing a delete operation, the database link is only aware of the entry's
DN. If an access control specifies a particular attribute, then a delete operation will fail when being
conducted through a database link.
NOTE
By default, access controls set on the server containing the database link are not
evaluated. To override this default, use the
nsCheckLocalACI
attribute in the
cn=
database_link,
cn=chaining database,cn=plugins,cn=config
entry.
However, evaluating access controls on the server containing the database link is not
recommended except with cascading chaining.
3.3.6. Advanced Feature: Tuning Database Link Performance
The following sections provide information on tuning the performance of database links through
connection and thread management.
•
Section 3.3.6.1, “Managing Connections to the Remote Server”
•
Section 3.3.6.2, “Detecting Errors During Normal Processing”
•
Section 3.3.6.3, “Managing Threaded Operations”