diff options
| author | André Malo <nd@apache.org> | 2002-11-16 21:21:38 +0100 |
|---|---|---|
| committer | André Malo <nd@apache.org> | 2002-11-16 21:21:38 +0100 |
| commit | 584bec3d859ab49411edec8dcfc96bfd4e1443d6 (patch) | |
| tree | aeff6423661fd0e9974f7c8d131018841de61337 | |
| parent | core_output_filter: back out changes to clean up resources before the end (diff) | |
| download | apache2-584bec3d859ab49411edec8dcfc96bfd4e1443d6.tar.xz apache2-584bec3d859ab49411edec8dcfc96bfd4e1443d6.zip | |
- <em> -> <var>
- little reformatting
-> update transformation
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97541 13f79535-47bb-0310-9956-ffa450edef68
| -rw-r--r-- | docs/manual/mod/index.html.en | 4 | ||||
| -rw-r--r-- | docs/manual/mod/mod_ldap.html.en | 202 | ||||
| -rw-r--r-- | docs/manual/mod/mod_ldap.xml | 207 | ||||
| -rw-r--r-- | docs/manual/mod/quickreference.html.en | 12 |
4 files changed, 214 insertions, 211 deletions
diff --git a/docs/manual/mod/index.html.en b/docs/manual/mod/index.html.en index f836a0bbf8..d61cd849f6 100644 --- a/docs/manual/mod/index.html.en +++ b/docs/manual/mod/index.html.en @@ -78,8 +78,8 @@ headers</dd> <dt><a href="mod_info.html">mod_info</a></dt><dd>Provides a comprehensive overview of the server configuration</dd> <dt><a href="mod_isapi.html">mod_isapi</a></dt><dd>ISAPI Extensions within Apache for Windows</dd> -<dt><a href="mod_ldap.html">mod_ldap</a></dt><dd>LDAP connection pooling and result caching -services for use by other LDAP modules</dd> +<dt><a href="mod_ldap.html">mod_ldap</a></dt><dd>LDAP connection pooling and result caching services for use +by other LDAP modules</dd> <dt><a href="mod_log_config.html">mod_log_config</a></dt><dd>Logging of the requests made to the server</dd> <dt><a href="mod_logio.html">mod_logio</a></dt><dd>Logging of input and output bytes per request</dd> <dt><a href="mod_mem_cache.html">mod_mem_cache</a></dt><dd>Content cache keyed to URIs</dd> diff --git a/docs/manual/mod/mod_ldap.html.en b/docs/manual/mod/mod_ldap.html.en index 17dc252795..79955d2dcd 100644 --- a/docs/manual/mod/mod_ldap.html.en +++ b/docs/manual/mod/mod_ldap.html.en @@ -5,8 +5,8 @@ This file is generated from xml source: DO NOT EDIT XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --><title>mod_ldap - Apache HTTP Server</title><link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /><link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /><link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link href="../images/favicon.ico" rel="shortcut icon" /></head><body><div id="page-header"><p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p><p class="apache">Apache HTTP Server Version 2.0</p><img alt="" src="../images/feather.gif" /></div><div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div><div id="path"><a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs-project/">Documentation</a> > <a href="../">Version 2.0</a> > <a href="./">Modules</a></div><div id="page-content"><div id="preamble"><h1>Apache Module mod_ldap</h1><table class="module"><tr><th><a href="module-dict.html#Description">Description: - </a></th><td>LDAP connection pooling and result caching -services for use by other LDAP modules</td></tr><tr><th><a href="module-dict.html#Status">Status: + </a></th><td>LDAP connection pooling and result caching services for use +by other LDAP modules</td></tr><tr><th><a href="module-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier: </a></th><td>ldap_module</td></tr><tr><th><a href="module-dict.html#SourceFile">Source File: </a></th><td>util_ldap.c</td></tr><tr><th><a href="module-dict.html#Compatibility">Compatibility: @@ -28,33 +28,36 @@ services for use by other LDAP modules</td></tr><tr><th><a href="module-dict.htm <li><img alt="" src="../images/down.gif" /> <a href="#ldapopcachettl">LDAPOpCacheTTL</a></li> <li><img alt="" src="../images/down.gif" /> <a href="#ldapsharedcachesize">LDAPSharedCacheSize</a></li> </ul><h3>Topics</h3><ul id="topics"><li><img alt="" src="../images/down.gif" /> <a href="#exampleconfig">Example Configuration</a></li><li><img alt="" src="../images/down.gif" /> <a href="#pool">LDAP Connection Pool</a></li><li><img alt="" src="../images/down.gif" /> <a href="#cache">LDAP Cache</a></li></ul></div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="section"><h2><a name="exampleconfig" id="exampleconfig">Example Configuration</a></h2> - -<p>The following is an example configuration that uses -<code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> to increase the performance of HTTP Basic -authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code>.</p> - -<div class="example"><pre> -# Enable the LDAP connection pool and shared memory cache. Enable the -# LDAP cache status handler. Requires that mod_ldap and mod_auth_ldap -# be loaded. Change the "yourdomain.example.com" to match your domain. - - LDAPSharedCacheSize 200000 - LDAPCacheEntries 1024 - LDAPCacheTTL 600 - LDAPOpCacheEntries 1024 - LDAPOpCacheTTL 600 - - <Location /ldap-status> - SetHandler ldap-status - Order deny,allow - Deny from all - Allow from yourdomain.example.com - AuthLDAPEnabled on - AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one - AuthLDAPAuthoritative on - require valid-user - </Location> -</pre></div> + <p>The following is an example configuration that uses + <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> to increase the performance of HTTP Basic + authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code>.</p> + + <div class="example"><p><code> + # Enable the LDAP connection pool and shared<br /> + # memory cache. Enable the LDAP cache status<br /> + # handler. Requires that mod_ldap and mod_auth_ldap<br /> + # be loaded. Change the "yourdomain.example.com" to<br /> + # match your domain.<br /> + <br /> + LDAPSharedCacheSize 200000<br /> + LDAPCacheEntries 1024<br /> + LDAPCacheTTL 600<br /> + LDAPOpCacheEntries 1024<br /> + LDAPOpCacheTTL 600<br /> + <br /> + <Location /ldap-status><br /> + <span class="indent"> + SetHandler ldap-status<br /> + Order deny,allow<br /> + Deny from all<br /> + Allow from yourdomain.example.com<br /> + AuthLDAPEnabled on<br /> + AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one<br /> + AuthLDAPAuthoritative on<br /> + require valid-user<br /> + </span> + </Location> + </code></p></div> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="section"><h2><a name="pool" id="pool">LDAP Connection Pool</a></h2> <p>LDAP connections are pooled from request to request. This @@ -81,77 +84,76 @@ authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.ht with mod_auth_ldap. In addition, the load on the LDAP server will be significantly decreased.</p> - <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> supports two types of LDAP caching during the - search/bind phase with a <em>search/bind cache</em> and + <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> supports two types of LDAP caching during + the search/bind phase with a <em>search/bind cache</em> and during the compare phase with two <em>operation caches</em>. Each LDAP URL that is used by the server has its own set of these three caches.</p> -<h3><a name="search-bind" id="search-bind">The Search/Bind Cache</a></h3> - - <p>The process of doing a search and then a bind is the - most time-consuming aspect of LDAP operation, especially if - the directory is large. The search/bind cache is used to - cache all searches that resulted in successful binds. - Negative results (i.e., unsuccessful searches, or searches - that did not result in a successful bind) are not cached. - The rationale behind this decision is that connections with - invalid credentials are only a tiny percentage of the total - number of connections, so by not caching invalid - credentials, the size of the cache is reduced.</p> - - <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> stores the username, the DN - retrieved, the password used to bind, and the time of the bind - in the cache. Whenever a new connection is initiated with the - same username, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> compares the password - of the new connection with the password in the cache. If the - passwords match, and if the cached entry is not too old, - <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> bypasses the search/bind phase.</p> - - <p>The search and bind cache is controlled with the <code class="directive"><a href="#ldapcacheentries">LDAPCacheEntries</a></code> and <code class="directive"><a href="#ldapcachettl">LDAPCacheTTL</a></code> directives.</p> - - -<h3><a name="opcaches" id="opcaches">Operation Caches</a></h3> - - <p>During attribute and distinguished name comparison - functions, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> uses two operation caches - to cache the compare operations. The first compare cache is - used to cache the results of compares done to test for LDAP - group membership. The second compare cache is used to cache - the results of comparisons done between distinguished - names.</p> - - <p>The behavior of both of these caches is controlled with - the <code class="directive"><a href="#ldapopcacheentries">LDAPOpCacheEntries</a></code> - and <code class="directive"><a href="#ldapopcachettl">LDAPOpCacheTTL</a></code> - directives.</p> - - -<h3><a name="monitoring" id="monitoring">Monitoring the Cache</a></h3> - - <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> has a content handler that allows - administrators to monitor the cache performance. The name of - the content handler is <code>ldap-status</code>, so the - following directives could be used to access the - <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache information:</p> -<div class="example"><pre> -<Location /server/cache-info > - SetHandler ldap-status -</Location> -</pre></div> - - <p>By fetching the URL - <code>http://servername/cache-info</code>, the administrator - can get a status report of every cache that is used by - <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache. Note that if Apache does not - support shared memory, then each <code>httpd</code> instance has its - own cache, so reloading the URL will result in different - information each time, depending on which <code>httpd</code> - instance processes the request.</p> - + <h3><a name="search-bind" id="search-bind">The Search/Bind Cache</a></h3> + <p>The process of doing a search and then a bind is the + most time-consuming aspect of LDAP operation, especially if + the directory is large. The search/bind cache is used to + cache all searches that resulted in successful binds. + Negative results (<em>i.e.</em>, unsuccessful searches, or searches + that did not result in a successful bind) are not cached. + The rationale behind this decision is that connections with + invalid credentials are only a tiny percentage of the total + number of connections, so by not caching invalid + credentials, the size of the cache is reduced.</p> + + <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> stores the username, the DN + retrieved, the password used to bind, and the time of the bind + in the cache. Whenever a new connection is initiated with the + same username, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> compares the password + of the new connection with the password in the cache. If the + passwords match, and if the cached entry is not too old, + <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> bypasses the search/bind phase.</p> + + <p>The search and bind cache is controlled with the <code class="directive"><a href="#ldapcacheentries">LDAPCacheEntries</a></code> and <code class="directive"><a href="#ldapcachettl">LDAPCacheTTL</a></code> directives.</p> + + + <h3><a name="opcaches" id="opcaches">Operation Caches</a></h3> + <p>During attribute and distinguished name comparison + functions, <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> uses two operation caches + to cache the compare operations. The first compare cache is + used to cache the results of compares done to test for LDAP + group membership. The second compare cache is used to cache + the results of comparisons done between distinguished + names.</p> + + <p>The behavior of both of these caches is controlled with + the <code class="directive"><a href="#ldapopcacheentries">LDAPOpCacheEntries</a></code> + and <code class="directive"><a href="#ldapopcachettl">LDAPOpCacheTTL</a></code> + directives.</p> + + + <h3><a name="monitoring" id="monitoring">Monitoring the Cache</a></h3> + <p><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> has a content handler that allows + administrators to monitor the cache performance. The name of + the content handler is <code>ldap-status</code>, so the + following directives could be used to access the + <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache information:</p> + + <div class="example"><p><code> + <Location /server/cache-info><br /> + <span class="indent"> + SetHandler ldap-status<br /> + </span> + </Location> + </code></p></div> + + <p>By fetching the URL <code>http://servername/cache-info</code>, + the administrator can get a status report of every cache that is used + by <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache. Note that if Apache does not + support shared memory, then each <code>httpd</code> instance has its + own cache, so reloading the URL will result in different + information each time, depending on which <code>httpd</code> + instance processes the request.</p> + </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPCacheEntries" id="LDAPCacheEntries">LDAPCacheEntries</a> <a name="ldapcacheentries" id="ldapcacheentries">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description: </a></th><td>Maximum number of entires in the primary LDAP cache</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: - </a></th><td><code>LDAPCacheEntries <em>number</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: + </a></th><td><code>LDAPCacheEntries <var>number</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: </a></th><td><code>LDAPCacheEntries 1024</code></td></tr><tr><th><a href="directive-dict.html#Context">Context: </a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module: @@ -162,7 +164,7 @@ authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.ht searches.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPCacheTTL" id="LDAPCacheTTL">LDAPCacheTTL</a> <a name="ldapcachettl" id="ldapcachettl">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description: </a></th><td>Time that cached items remain valid</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: - </a></th><td><code>LDAPCacheTTL <em>seconds</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: + </a></th><td><code>LDAPCacheTTL <var>seconds</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: </a></th><td><code>LDAPCacheTTL 600</code></td></tr><tr><th><a href="directive-dict.html#Context">Context: </a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module: @@ -172,7 +174,7 @@ authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.ht minutes).</p> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPCertDBPath" id="LDAPCertDBPath">LDAPCertDBPath</a> <a name="ldapcertdbpath" id="ldapcertdbpath">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description: </a></th><td>Directory containing certificates for SSL support</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: - </a></th><td><code>LDAPCertDBPath <em>directory-path</em></code></td></tr><tr><th><a href="directive-dict.html#Context">Context: + </a></th><td><code>LDAPCertDBPath <var>directory-path</var></code></td></tr><tr><th><a href="directive-dict.html#Context">Context: </a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module: </a></th><td>mod_ldap</td></tr></table> @@ -186,7 +188,7 @@ authentication provided by <code class="module"><a href="../mod/mod_auth_ldap.ht </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPOpCacheEntries" id="LDAPOpCacheEntries">LDAPOpCacheEntries</a> <a name="ldapopcacheentries" id="ldapopcacheentries">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description: </a></th><td>Number of entries used to cache LDAP compare operations</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: - </a></th><td><code>LDAPOpCacheEntries <em>number</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: + </a></th><td><code>LDAPOpCacheEntries <var>number</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: </a></th><td><code>LDAPOpCacheEntries 1024</code></td></tr><tr><th><a href="directive-dict.html#Context">Context: </a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module: @@ -195,9 +197,9 @@ operations</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: will use to cache LDAP compare operations. The default is 1024 entries. Setting it to 0 disables operation caching.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPOpCacheTTL" id="LDAPOpCacheTTL">LDAPOpCacheTTL</a> <a name="ldapopcachettl" id="ldapopcachettl">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description: - </a></th><td>Time that entries in the operation cache remain + </a></th><td>Time that entries in the operation cache remain valid</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: - </a></th><td><code>LDAPOpCacheTTL <em>seconds</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: + </a></th><td><code>LDAPOpCacheTTL <var>seconds</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: </a></th><td><code>LDAPOpCacheTTL 600</code></td></tr><tr><th><a href="directive-dict.html#Context">Context: </a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module: @@ -206,7 +208,7 @@ valid</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: operation cache remain valid. The default is 600 seconds.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div><div class="directive-section"><h2><a name="LDAPSharedCacheSize" id="LDAPSharedCacheSize">LDAPSharedCacheSize</a> <a name="ldapsharedcachesize" id="ldapsharedcachesize">Directive</a></h2><table class="directive"><tr><th><a href="directive-dict.html#Description">Description: </a></th><td>Size in bytes of the shared-memory cache</td></tr><tr><th><a href="directive-dict.html#Syntax">Syntax: - </a></th><td><code>LDAPSharedCacheSize <em>bytes</em></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: + </a></th><td><code>LDAPSharedCacheSize <var>bytes</var></code></td></tr><tr><th><a href="directive-dict.html#Default">Default: </a></th><td><code>LDAPSharedCacheSize 102400</code></td></tr><tr><th><a href="directive-dict.html#Context">Context: </a></th><td>server config</td></tr><tr><th><a href="directive-dict.html#Status">Status: </a></th><td>Experimental</td></tr><tr><th><a href="directive-dict.html#Module">Module: diff --git a/docs/manual/mod/mod_ldap.xml b/docs/manual/mod/mod_ldap.xml index 94568f4fe6..3418617f5f 100644 --- a/docs/manual/mod/mod_ldap.xml +++ b/docs/manual/mod/mod_ldap.xml @@ -4,8 +4,8 @@ <modulesynopsis> <name>mod_ldap</name> -<description>LDAP connection pooling and result caching -services for use by other LDAP modules</description> +<description>LDAP connection pooling and result caching services for use +by other LDAP modules</description> <status>Experimental</status> <sourcefile>util_ldap.c</sourcefile> <identifier>ldap_module</identifier> @@ -25,34 +25,36 @@ services for use by other LDAP modules</description> </summary> <section id="exampleconfig"><title>Example Configuration</title> - -<p>The following is an example configuration that uses -<module>mod_ldap</module> to increase the performance of HTTP Basic -authentication provided by <module>mod_auth_ldap</module>.</p> - -<example> -<pre> -# Enable the LDAP connection pool and shared memory cache. Enable the -# LDAP cache status handler. Requires that mod_ldap and mod_auth_ldap -# be loaded. Change the "yourdomain.example.com" to match your domain. - - LDAPSharedCacheSize 200000 - LDAPCacheEntries 1024 - LDAPCacheTTL 600 - LDAPOpCacheEntries 1024 - LDAPOpCacheTTL 600 - - <Location /ldap-status> - SetHandler ldap-status - Order deny,allow - Deny from all - Allow from yourdomain.example.com - AuthLDAPEnabled on - AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one - AuthLDAPAuthoritative on - require valid-user - </Location> -</pre></example> + <p>The following is an example configuration that uses + <module>mod_ldap</module> to increase the performance of HTTP Basic + authentication provided by <module>mod_auth_ldap</module>.</p> + + <example> + # Enable the LDAP connection pool and shared<br /> + # memory cache. Enable the LDAP cache status<br /> + # handler. Requires that mod_ldap and mod_auth_ldap<br /> + # be loaded. Change the "yourdomain.example.com" to<br /> + # match your domain.<br /> + <br /> + LDAPSharedCacheSize 200000<br /> + LDAPCacheEntries 1024<br /> + LDAPCacheTTL 600<br /> + LDAPOpCacheEntries 1024<br /> + LDAPOpCacheTTL 600<br /> + <br /> + <Location /ldap-status><br /> + <indent> + SetHandler ldap-status<br /> + Order deny,allow<br /> + Deny from all<br /> + Allow from yourdomain.example.com<br /> + AuthLDAPEnabled on<br /> + AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one<br /> + AuthLDAPAuthoritative on<br /> + require valid-user<br /> + </indent> + </Location> + </example> </section> <section id="pool"><title>LDAP Connection Pool</title> @@ -83,82 +85,81 @@ authentication provided by <module>mod_auth_ldap</module>.</p> with mod_auth_ldap. In addition, the load on the LDAP server will be significantly decreased.</p> - <p><module>mod_ldap</module> supports two types of LDAP caching during the - search/bind phase with a <em>search/bind cache</em> and + <p><module>mod_ldap</module> supports two types of LDAP caching during + the search/bind phase with a <em>search/bind cache</em> and during the compare phase with two <em>operation caches</em>. Each LDAP URL that is used by the server has its own set of these three caches.</p> -<section id="search-bind"><title>The Search/Bind Cache</title> - - <p>The process of doing a search and then a bind is the - most time-consuming aspect of LDAP operation, especially if - the directory is large. The search/bind cache is used to - cache all searches that resulted in successful binds. - Negative results (i.e., unsuccessful searches, or searches - that did not result in a successful bind) are not cached. - The rationale behind this decision is that connections with - invalid credentials are only a tiny percentage of the total - number of connections, so by not caching invalid - credentials, the size of the cache is reduced.</p> - - <p><module>mod_ldap</module> stores the username, the DN - retrieved, the password used to bind, and the time of the bind - in the cache. Whenever a new connection is initiated with the - same username, <module>mod_ldap</module> compares the password - of the new connection with the password in the cache. If the - passwords match, and if the cached entry is not too old, - <module>mod_ldap</module> bypasses the search/bind phase.</p> - - <p>The search and bind cache is controlled with the <directive - module="mod_ldap">LDAPCacheEntries</directive> and <directive - module="mod_ldap">LDAPCacheTTL</directive> directives.</p> -</section> - -<section id="opcaches"><title>Operation Caches</title> - - <p>During attribute and distinguished name comparison - functions, <module>mod_ldap</module> uses two operation caches - to cache the compare operations. The first compare cache is - used to cache the results of compares done to test for LDAP - group membership. The second compare cache is used to cache - the results of comparisons done between distinguished - names.</p> - - <p>The behavior of both of these caches is controlled with - the <directive module="mod_ldap">LDAPOpCacheEntries</directive> - and <directive module="mod_ldap">LDAPOpCacheTTL</directive> - directives.</p> -</section> - -<section id="monitoring"><title>Monitoring the Cache</title> - - <p><module>mod_ldap</module> has a content handler that allows - administrators to monitor the cache performance. The name of - the content handler is <code>ldap-status</code>, so the - following directives could be used to access the - <module>mod_ldap</module> cache information:</p> -<example><pre> -<Location /server/cache-info > - SetHandler ldap-status -</Location> -</pre></example> - - <p>By fetching the URL - <code>http://servername/cache-info</code>, the administrator - can get a status report of every cache that is used by - <module>mod_ldap</module> cache. Note that if Apache does not - support shared memory, then each <code>httpd</code> instance has its - own cache, so reloading the URL will result in different - information each time, depending on which <code>httpd</code> - instance processes the request.</p> -</section> + <section id="search-bind"><title>The Search/Bind Cache</title> + <p>The process of doing a search and then a bind is the + most time-consuming aspect of LDAP operation, especially if + the directory is large. The search/bind cache is used to + cache all searches that resulted in successful binds. + Negative results (<em>i.e.</em>, unsuccessful searches, or searches + that did not result in a successful bind) are not cached. + The rationale behind this decision is that connections with + invalid credentials are only a tiny percentage of the total + number of connections, so by not caching invalid + credentials, the size of the cache is reduced.</p> + + <p><module>mod_ldap</module> stores the username, the DN + retrieved, the password used to bind, and the time of the bind + in the cache. Whenever a new connection is initiated with the + same username, <module>mod_ldap</module> compares the password + of the new connection with the password in the cache. If the + passwords match, and if the cached entry is not too old, + <module>mod_ldap</module> bypasses the search/bind phase.</p> + + <p>The search and bind cache is controlled with the <directive + module="mod_ldap">LDAPCacheEntries</directive> and <directive + module="mod_ldap">LDAPCacheTTL</directive> directives.</p> + </section> + + <section id="opcaches"><title>Operation Caches</title> + <p>During attribute and distinguished name comparison + functions, <module>mod_ldap</module> uses two operation caches + to cache the compare operations. The first compare cache is + used to cache the results of compares done to test for LDAP + group membership. The second compare cache is used to cache + the results of comparisons done between distinguished + names.</p> + + <p>The behavior of both of these caches is controlled with + the <directive module="mod_ldap">LDAPOpCacheEntries</directive> + and <directive module="mod_ldap">LDAPOpCacheTTL</directive> + directives.</p> + </section> + + <section id="monitoring"><title>Monitoring the Cache</title> + <p><module>mod_ldap</module> has a content handler that allows + administrators to monitor the cache performance. The name of + the content handler is <code>ldap-status</code>, so the + following directives could be used to access the + <module>mod_ldap</module> cache information:</p> + + <example> + <Location /server/cache-info><br /> + <indent> + SetHandler ldap-status<br /> + </indent> + </Location> + </example> + + <p>By fetching the URL <code>http://servername/cache-info</code>, + the administrator can get a status report of every cache that is used + by <module>mod_ldap</module> cache. Note that if Apache does not + support shared memory, then each <code>httpd</code> instance has its + own cache, so reloading the URL will result in different + information each time, depending on which <code>httpd</code> + instance processes the request.</p> + </section> </section> <directivesynopsis> <name>LDAPSharedCacheSize</name> <description>Size in bytes of the shared-memory cache</description> -<syntax>LDAPSharedCacheSize <em>bytes</em></syntax> +<syntax>LDAPSharedCacheSize <var>bytes</var></syntax> <default>LDAPSharedCacheSize 102400</default> <contextlist><context>server config</context></contextlist> @@ -171,7 +172,7 @@ authentication provided by <module>mod_auth_ldap</module>.</p> <directivesynopsis> <name>LDAPCacheEntries</name> <description>Maximum number of entires in the primary LDAP cache</description> -<syntax>LDAPCacheEntries <em>number</em></syntax> +<syntax>LDAPCacheEntries <var>number</var></syntax> <default>LDAPCacheEntries 1024</default> <contextlist><context>server config</context></contextlist> @@ -186,7 +187,7 @@ authentication provided by <module>mod_auth_ldap</module>.</p> <directivesynopsis> <name>LDAPCacheTTL</name> <description>Time that cached items remain valid</description> -<syntax>LDAPCacheTTL <em>seconds</em></syntax> +<syntax>LDAPCacheTTL <var>seconds</var></syntax> <default>LDAPCacheTTL 600</default> <contextlist><context>server config</context></contextlist> @@ -201,7 +202,7 @@ authentication provided by <module>mod_auth_ldap</module>.</p> <name>LDAPOpCacheEntries</name> <description>Number of entries used to cache LDAP compare operations</description> -<syntax>LDAPOpCacheEntries <em>number</em></syntax> +<syntax>LDAPOpCacheEntries <var>number</var></syntax> <default>LDAPOpCacheEntries 1024</default> <contextlist><context>server config</context></contextlist> @@ -214,9 +215,9 @@ operations</description> <directivesynopsis> <name>LDAPOpCacheTTL</name> -<description>Time that entries in the operation cache remain +<description>Time that entries in the operation cache remain valid</description> -<syntax>LDAPOpCacheTTL <em>seconds</em></syntax> +<syntax>LDAPOpCacheTTL <var>seconds</var></syntax> <default>LDAPOpCacheTTL 600</default> <contextlist><context>server config</context></contextlist> @@ -229,7 +230,7 @@ valid</description> <directivesynopsis> <name>LDAPCertDBPath</name> <description>Directory containing certificates for SSL support</description> -<syntax>LDAPCertDBPath <em>directory-path</em></syntax> +<syntax>LDAPCertDBPath <var>directory-path</var></syntax> <contextlist><context>server config</context></contextlist> <usage> diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index 7f9b3329fb..72cc60bd09 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -333,14 +333,14 @@ extensions</td></tr> requests on a persistent connection</td></tr> <tr><td><a href="mod_negotiation.html#languagepriority" id="L" name="L">LanguagePriority <em>MIME-lang</em> [<em>MIME-lang</em>] ...</a></td><td /><td>svdh</td><td>B</td></tr><tr><td class="descr" colspan="4">The precendence of language variants for cases where the client does not express a preference</td></tr> -<tr class="odd"><td><a href="mod_ldap.html#ldapcacheentries">LDAPCacheEntries <em>number</em></a></td><td> 1024 </td><td>s</td><td>X</td></tr><tr class="odd"><td class="descr" colspan="4">Maximum number of entires in the primary LDAP cache</td></tr> -<tr><td><a href="mod_ldap.html#ldapcachettl">LDAPCacheTTL <em>seconds</em></a></td><td> 600 </td><td>s</td><td>X</td></tr><tr><td class="descr" colspan="4">Time that cached items remain valid</td></tr> -<tr class="odd"><td><a href="mod_ldap.html#ldapcertdbpath">LDAPCertDBPath <em>directory-path</em></a></td><td /><td>s</td><td>X</td></tr><tr class="odd"><td class="descr" colspan="4">Directory containing certificates for SSL support</td></tr> -<tr><td><a href="mod_ldap.html#ldapopcacheentries">LDAPOpCacheEntries <em>number</em></a></td><td> 1024 </td><td>s</td><td>X</td></tr><tr><td class="descr" colspan="4">Number of entries used to cache LDAP compare +<tr class="odd"><td><a href="mod_ldap.html#ldapcacheentries">LDAPCacheEntries <var>number</var></a></td><td> 1024 </td><td>s</td><td>X</td></tr><tr class="odd"><td class="descr" colspan="4">Maximum number of entires in the primary LDAP cache</td></tr> +<tr><td><a href="mod_ldap.html#ldapcachettl">LDAPCacheTTL <var>seconds</var></a></td><td> 600 </td><td>s</td><td>X</td></tr><tr><td class="descr" colspan="4">Time that cached items remain valid</td></tr> +<tr class="odd"><td><a href="mod_ldap.html#ldapcertdbpath">LDAPCertDBPath <var>directory-path</var></a></td><td /><td>s</td><td>X</td></tr><tr class="odd"><td class="descr" colspan="4">Directory containing certificates for SSL support</td></tr> +<tr><td><a href="mod_ldap.html#ldapopcacheentries">LDAPOpCacheEntries <var>number</var></a></td><td> 1024 </td><td>s</td><td>X</td></tr><tr><td class="descr" colspan="4">Number of entries used to cache LDAP compare operations</td></tr> -<tr class="odd"><td><a href="mod_ldap.html#ldapopcachettl">LDAPOpCacheTTL <em>seconds</em></a></td><td> 600 </td><td>s</td><td>X</td></tr><tr class="odd"><td class="descr" colspan="4">Time that entries in the operation cache remain +<tr class="odd"><td><a href="mod_ldap.html#ldapopcachettl">LDAPOpCacheTTL <var>seconds</var></a></td><td> 600 </td><td>s</td><td>X</td></tr><tr class="odd"><td class="descr" colspan="4">Time that entries in the operation cache remain valid</td></tr> -<tr><td><a href="mod_ldap.html#ldapsharedcachesize">LDAPSharedCacheSize <em>bytes</em></a></td><td> 102400 </td><td>s</td><td>X</td></tr><tr><td class="descr" colspan="4">Size in bytes of the shared-memory cache</td></tr> +<tr><td><a href="mod_ldap.html#ldapsharedcachesize">LDAPSharedCacheSize <var>bytes</var></a></td><td> 102400 </td><td>s</td><td>X</td></tr><tr><td class="descr" colspan="4">Size in bytes of the shared-memory cache</td></tr> <tr class="odd"><td><a href="core.html#limit"><Limit <var>method</var> [<var>method</var>] ... > ... </Limit></a></td><td /><td>svdh</td><td>C</td></tr><tr class="odd"><td class="descr" colspan="4">Restrict enclosed access controls to only certain HTTP methods</td></tr> |