How to speed up combined ldap query?

Question

This ldap query is instantaneous:

"Find all groups which user1 is not member"
(&
    (objectclass=groupOfNames)
    (!(member=cn=user1))
)

As is this one:

"Find these groups"
(&
    (objectclass=groupOfNames)
    (|(cn=group1) (cn=group2) (cn=group3) ...  )
)

But, combining them like this results in several minutes of processing!

"From these groups, find all which the user1 is not a member"
(&
    (objectclass=groupOfNames)
    (!(member=cn=user1))
    (|(cn=group1) (cn=group2) (cn=group3) ...  )
)

I have no idea why the ldap server chokes on the combined query. Any ideas what can be done?

The server is Novell eDirectory if that helps.

Answer 1

It is strange that it takes several minutes to get the result. Do you have more than a couple million objects?

One possibility might be, that search 1 is only looking within one partition of your tree, search 2 in another, and both combined would then obviously look into both, which should be fine, as long as the server you are asking has at least read replica on these partitions.

Also, can you please try the following variant:

(&

  (&
    (objectclass=groupOfNames)(!(member=cn=user1))
  )

  (&
    (objectclass=groupOfNames)(|(cn=group1) (cn=group2) (cn=group3) ...  )
  )

)

It should give you the answer you were initial querying for, but on a bit simpley way.

If this does not help you should do an ndstrace on the queried server and see what he is doing exactly with the query.

So in short:

1. Obivously: make sure your NDS is healthy (ndsrepair, TID 3564075 and whatnot)
2. check if both queries are in the same partition
3. check if the server has at least a read replica of the partition(s)
4. try to modify the query as suggested
5. do an ndstrace while querying to see whats taking so long