17.2 Disabling User Profile Objects

If you are not using the default configuration for storing Form Fill secrets and you have not enabled persistent federation between identity and service providers, you can disable the creation of objects under the LibertyUserProfile container in the configuration datastore. The default behavior is to create an object in this container for every user accessing the system, and the login process checks for a matching user in this container.

If you have hundreds of thousands of users, the following symptoms might indicate that the user profile objects are slowing down the login process:

  • On the Administration Console, the ndsd process (Linux) or the NDS Server (Windows) is running at 100%.

  • Running the backup utility is very slow.

  • Logging in to the Administration Console is very slow.

To discover whether profile objects might be causing a slowdown, open an LDAP browser (or in the Administration Console, select the View Objects task in the menu bar). Expand the following objects: novell > accessManagerContainer > nids > cluster. Expand the SCC objects, and look for objects stored in LibertyUserProfile objects.

  • If you have only a few hundred of these objects, user profile objects are not slowing the authentication process.

  • If you have thousands of these objects, user profile objects are probably causing a slowdown. You can speed up authentication by disabling the use of these objects. When you do this, the Identity Server no longer creates objects in the LibertyUserProfile container, and it does not try to match an authenticating user with a profile object.

To prevent the creation and use of user profile objects, make the following modifications to your Identity Server configuration:

  1. In the Administration Console, click Devices > Identity Servers > Edit > Liberty > Web Service Provider.

  2. Disable the following profiles:

    • Personal Profile

    • Employee Profile

    • Custom Profile

  3. Either disable the Credential Profile (which also disables using Form Fill or Identity Injection with credentials) or enable the Credential Profile and modify its default configuration:

    1. Click Credential Profile.

    2. Select to store secrets either with the Extended Schema User References option or with the Novell Secret Store User Store References option.

      When the Credential Profile is enabled, the default behavior is to create user profile objects and store the secrets there. You must configure one of these other options to store the secrets. For more information about these options, see Section 3.1.4, Configuring a User Store for Secrets.

  4. Click OK twice, then update the Identity Server.

  5. To disable the use of the user profile objects:

    1. Log in to the Identity Server machine as the root user.

    2. Open the web.xml file located at :

      Linux: /opt/novell/nam/idp/webapps/nidp/WEB-INF/

      Windows Server 2008: \Program Files (x86)\Novell\Tomcat\webapps\nidp\WEB-INF/

    3. Add the following lines to the file:

      <context-param>
  <param-name>cpAuthorityType</param-name>
  <param-value>memory</param-value>
</context-param>

    4. Restart Tomcat.

      Linux: Enter the following command:

      /etc/init.d/novell-idp restart

      Windows: Enter the following commands:

      net stop Tomcat7

      net start Tomcat7

    5. Make this change on each Identity Server in the cluster.