Novell ACCESS MANAGER 3.1 SP2 - README 2010, Руководство пользователя

Страница: 345 / 374

Maintaining an Identity Server 345
n
ov
do
cx (e
n)
16
Ap
ril 20
10
you enable sticky bit/persistence on the L4 switch. When this feature is not enabled, the product
handles the traffic correctly, but the system can run up to 50% slower than when persistence is
enabled. For tips on how to set up the L4 switch, see “
Configuration Tips for the L4 Switch ” in the
Novell Access Manager 3.1 SP2 Setup Guide .
Enabled Protocols: On the General Configuration page (click Devices > Identity Servers > Edit ),
you can select which protocols to enable. The Liberty protocol needs to be enabled, but each
additional protocol adds a little processing overhead. Do not enable protocols unless you are using
them.
Session Failover: On the Cluster Details page (click Devices > [Name of Cluster] ), you can set up
session failover so that if an Identity Server in the cluster goes down, the user does not lose any
session data. This feature adds some overhead, because the Identity Servers need to share some
authentication information. You need to balance the need to preserve user session data with the
increase in authentication traffic. For best performance, you should specify the minimum number of
peers.
Limit User Sessions: On the General Configuration page (click Devices > Identity Servers > Edit ),
you can select to limit the number of sessions a user can have. When a user is limited to a specific
number of sessions, the Identity Servers must check with the other servers in the cluster before
establishing a new session. This check adds a little bit of overhead to each new authentication
request.
Authentication Timeouts: For each contract (click Devices > Identity Servers > Edit > > Local >
Contracts > [Name of Contract] ), you need to specify an authentication timeout. Short timeouts
generate more authentication traffic. Carefully consider the security requirements for your resources
and set limits that meet the requirements. If you only need to verify that the users are actively using
a session, have all these protected resources use the same contract or have them share the same
activity realm.
Logging: You need to manage the size and number of log files as well as the logging level. You
should increase the log level to Debug only when you are troubleshooting a problem. As soon as the
problem is resolved, you should reduce the log level. You should also have a schedule for checking
the number and size of the log files and for removing the older log files.
Auditing: You need to carefully select the events that you audit. Selecting all events that are
available for the Access Manager components can impact performance. For example, the Login
Provided event generates an event every time a user authenticates. If you have many users, this one
event could impact performance. You need to analyze your needs. Are you really interested in who
logged in, or are you more interested in who failed to log in?
User Profile Objects: If you are not using the default configuration for storing Form Fill secrets
and you have not enabled persistent federation between identity and service providers, you can
disable the creation of objects under the LibertyUserProfile container in the configuration datastore.
The default behavior is to create an object in this container for every user accessing the system, and
the login process checks for a matching user in this container.
If you have hundreds of thousands of users, the following symptoms might indicate that the user
profile objects are slowing down the login process:

On the Administration Console, the ndsd process (Linux) or the NDS Server (Windows) is
running at 100%.

Running the backup utility is very slow.
 Logging in to the Administration Console is very slow.