Tech Tip - CA Privileged Identity Manager: Poor performance on ENTM web interface

[Renato_Pioker]

CA Privileged Identity Manager Tech Tip by Renato Pioker, Support Engineer for July 21st, 2015.

 

Sometimes you may experience poor performance when logging in or searching objects in ENTM Portal. One of the most common causes is when you define Microsoft Active Directory as the User Store using the default LDAP port (SSL or not).

 

This is caused by some characteristics from AD itself – the way the Domain Controllers do the search and how they store and distribute the objects and the cache may slow down the searches while a user tries to authenticate or search objects via LDAP.

 

To avoid this you can just reconfigure the User Store connection to point to the Global Catalog port. To achieve this, follow the steps below:

 

1. Log in to Management Console (http://<ENTM_server>:<ENTM_port>/idmmanage - use https if your environment is configured to use SSL);
2. Navigate to Directories;
3. Click on “ac-dir” and click the Export button;
4. Save the resulting XML to a temporary location;
5. Edit the XML you saved using a text file editor, such as Notepad or Vim;
6. Change the field “Connection port” like the following example: [From: <Connection port="389" host="servername.mydomain.com"/>] [To: <Connection port="3268" host="mydomain.com"/>]. Please note that, if you have more than one Global Catalog server in your AD topology, you will need to configure the domain name + the Global Catalog IP address into the “hosts” file;
7. Save the file;
8. Repeat the steps from 1 to 3 but, instead of clicking the Export button, you will click the Update button;
9. Click the Browse button;
10. Navigate to the directory where you saved the XML file in step 4 above;
11. Click once on the file to select it;
12. Click the Open button;
13. Click the Finish button;
14. Once the import process completes, click the Continue button;
15. Click the Restart Environment button.

 

Now your ENTM is configured to access the Global Catalog service. The Global Catalog stores all the information that resides in Active Directory, no matter the partitions and topology you have, in a cache. That’s why the searches are faster than when using the common LDAP connection – the Global Catalog can search the entire forest at once.

UPDATE: If you receive an error while uploading the XML back to IDMMANAGE, please do the following:

Edit the XML and locate the following line:

 

<Container objectclass="top,organizationalUnit" attribute="ou"/>

 

Change it to:

 

<Container objectclass="top,organizationalUnit" attribute="ou" value="Users"/>

 

Upload the file again.

 

Message was edited by: Renato Pioker

[VinayReddy]

Hi,

 

Will this change have any impact if the PIM ENTM is integrated with Siteminder?

 

Thank You

[Renato_Pioker]

Hi. Sorry for the delay on providing this answer.

 

If your ENTM is integrated with SiteMinder, and you make changes on the ENTM user store, it is a good practice to check your SiteMinder Admin UI to guarantee that the change you made was properly propagated to SiteMinder. This way you avoid potential login issues.

 

Kind Regards,

Renato