add a note about sub-group searching and large groups.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1525588 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_authnz_ldap.html.en b/docs/manual/mod/mod_authnz_ldap.html.en
index 652c4c94c497921a0b1fbfdb5c14a337d9059508..c0ff91994468ba3ffaf20fa54357ed068c5a2ddc 100644 (file)
--- a/docs/manual/mod/mod_authnz_ldap.html.en
+++ b/docs/manual/mod/mod_authnz_ldap.html.en
@@ -1132,6 +1132,15 @@ evaluated before the user search is discontinued.</td></tr>
    <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
    section for a more detailed example.</p>
 
+   <div class="note"><h3>Nested groups performance</h3>
+   <p> When <code class="directive">AuthLDAPSubGroupAttribute</code> overlaps with
+   <code class="directive">AuthLDAPGroupAttribute</code> (as it does by default and
+   as required by common LDAP schemas), uncached searching for subgroups in 
+   large groups can be very slow. If you use large, non-nested groups, set 
+   <code class="directive">AuthLDAPMaxSubGroupDepth</code> to zero.</p>
+   </div>
+
+
 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthLDAPRemoteUserAttribute" id="AuthLDAPRemoteUserAttribute">AuthLDAPRemoteUserAttribute</a> <a name="authldapremoteuserattribute" id="authldapremoteuserattribute">Directive</a></h2>

diff --git a/docs/manual/mod/mod_authnz_ldap.xml b/docs/manual/mod/mod_authnz_ldap.xml
index 7d22417eba5dc7a40ecc54a4808650b634243fc5..c3d033a1241aa14c96145bec50a9dc3ed7dcaef8 100644 (file)
--- a/docs/manual/mod/mod_authnz_ldap.xml
+++ b/docs/manual/mod/mod_authnz_ldap.xml
@@ -1089,6 +1089,15 @@ evaluated before the user search is discontinued.</description>
    level <code>X</code> specified by this directive.</p>
    <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
    section for a more detailed example.</p>
+
+   <note><title>Nested groups performance</title>
+   <p> When <directive>AuthLDAPSubGroupAttribute</directive> overlaps with
+   <directive>AuthLDAPGroupAttribute</directive> (as it does by default and
+   as required by common LDAP schemas), uncached searching for subgroups in 
+   large groups can be very slow. If you use large, non-nested groups, set 
+   <directive>AuthLDAPMaxSubGroupDepth</directive> to zero.</p>
+   </note>
+
 </usage>
 </directivesynopsis>