Accounts in UCM 11g from external LDAP provider

Question

Hi,
We are developing an application using UCM 11g. For authentication and authorization we are using external LDAP. Following are the steps followed to configure the UCM 11g for external LDAP.
1) Created User and Groups directory in LDAP
2) Created user and group in LDAP.
3) Assigned users to the groups.
3) Created accounts in group directory .Account name start with @ and ends with (RW)
4) Created a new provider in WLS.
5) Created a new JpsProvider in UCM.
Now, roles(groups in LDAP) and user are coming properly form LDAP. but the accounts are populating in UCM.
Can anybody tell me the solution for this problem
Thanks in advance..
Regards,
Nitin

Answer 1

In theory there is no limit, but as with most of the products and features inside the Content Server it comes down to design and size impacting performance.
So there is no simple answer.
The more complex answer is you need to try to keep things as simple as possible while still completing your goals.
For instance the Folders component in 11g is limited (hard coded) to 1000 files per folder maximum due to performance degradation if you put more in your folders. Many people just try to put more in and before the hard coded limit in 11g people did and their folders browsing became almost unusable due to slow browsing of the folder structure and files in side.
Similarly with Security we can impact performance with too many security groups, badly designed Roles to access security groups or badly designed Account structures. Notice I only said "too many" on Security groups but not "too many" on Accounts. You should try never to go above 25 security groups (this is not a hard coded limit just a best practice) and the "badly designed" part of roles and accounts can lead to bad performance and even broken security.
It comes down to DB performance, DB limitations and code limits.
First off be aware that there is a limit on how long a query in the DB can be. Commands and SQL in the DB are not endlessly long, there is a maximum number of characters. Keep that in mind as we go along into the next parts.
Second be aware that if you make a badly built query it will take a long long time.
Third be aware that when you are building security models in UCM these security structures go DIRECTLY to DB queries and remember the above 2 points.
So every search in UCM is a query when you take it back to the DB level, and every search requires a behind the scenes security check to make sure you can read the documents you are searching for. So any query built in the search interface gets an additional set of parameters automatically when executed (security).
So now we need to also think about your Metadata and not just the Security on that limited length DB back end. Do your users have 99 metadata fields (I hope not) and if they do do they use most of them while searching? How long will that query be before you add the security query?
Back to the security parts with accounts.
If you have your users having only a few roles providing only access to a small number of security groups and those same users only having a few accounts then searches will get a short security access query added since the number of additional checks for security are small. If the roles and group accesses and account accesses are very large (to the extreme limit) again this will be easy to make a short query due to the small number of excluded security roles and accounts.
BUT and this is a biggie. IF the users are given a number of roles and accounts that is middle of the road for number of total accesses then the query is as long as it can be and if the metadata is complex and large too then you may be running into the limit of Query string in the DB and your query may get truncated which results in a broken security model maybe.
That is not even talking about the efficiency of the query and how long it takes.....
Sorry for the book like reply to your simple question, but it really is not a simple question. :)