Tech Talk: Want to get in on the Secret? How fast is your Directory?

World®’16

TechTalk:WanttoGetinontheSecret?HowFastisYourDirectory?GregVickery– PrincipalServicesConsultant– CATechnologies

SCT45T

SECURITY

2 ©2016CA.ALLRIGHTSRESERVED.@CAWORLD#CAWORLD

©2016CA.Allrightsreserved.Alltrademarksreferencedhereinbelongtotheirrespectivecompanies.

Thecontentprovidedinthis CAWorld2016presentationisintendedforinformationalpurposesonlyanddoesnotformanytypeofwarranty. The informationprovidedbyaCApartnerand/orCAcustomerhasnotbeenreviewedforaccuracybyCA.

ForInformationalPurposesOnlyTermsofthisPresentation


Abstract

CADirectoryhasconsistentlyoutperformedleadingdirectoryserviceswhentestedagainstotherthird-partyproducts.Howfastisyourdirectory?Whysettleforgoodperformancewhenyoucanhavegreatperformance.Comebyandlearnmore.

GregVickery

CATechnologiesPrincipalServicesConsultant


Agenda

WHATISPERFORMANCE?

WHYISPERFORMANCEIMPORTANT?

OPERATIONSMADEEASIER

MORETHANJUSTSEARCH

REPLICATIONPERFORMANCENOTJUSTUPDATEPERFORMANCE

OPTIMIZETHECONFIGURATION

1

2

3

4

5

6


DirectoryReview

§ Applicationcommunicatingwithadatastore– Viaprotocol- LDAP

§ Performance:– Howquicklyisdataavailable– Howquicklyisdatareplicated

LevelSettheConversation

LDAP

ApplicationLayer


WhyIsPerformanceImportant?


CADirectoryPerformance

§ SupportIncreasedOnlinePresence

§ DirectoryPerformancetranslatesintoUserExperience

§ AnApplicationTransactionmaybeseveralDirectoryrequests

– CASSOTransactionoftenincludes3+Searches,aBindandanUpdateforeveryauthentication

– Justafewextramillisecondsoneachcanadduptoslowresponsetimes

ConsiderApplicationBehavior



§ BusinessUnitsoftenDriveDevTeams– Developersmaynothavetimetointegratetootherapplications– TightTimelinesoftenmeaninefficientApplications

CaseStudy:Asingleuserauthenticationcausesupto15requestsonthedirectory

§ NottheDevTeamsfault– DirectoryInfrastructuremustsupportthisFact.

PerformancetoOffsetApplicationInefficiencies


Let’sTalkPerformance!



§ Performance– Rawthrough-put- FastSearch/AuthN/Updates/Replication

§ Smallfootprint– Verylargeenvironmentsw/fewerservers– Lesstomanageandmonitor

§ OperationalAdvantages(easytomanage)– NoTuningRequired(nomaintenance)– Veryfastbackupandrestore

Expandthe‘Performance’Discussion


CADirectoryPerformanceCustomerTesting(WithOnly4DirectoryServers)

61,795Operations/Second



Performance(Alltestsforaperiodof30minutes– overSSL)

UserSearchandAuthentication

(bind)UserSearches Modify(~17ms

replicationtoall)


AMemoryMappingApproachIsMuchFasterThanItsDatabase-DrivenCounterparts

LDAPCache+Database Memory-Mapping

Results§ 10,000reads/sec§ 10,000writes/sec

Results*§ 1000reads/sec§ 100writes/sec

LDAP Database

Cache

CADirectory Disk

DiskI/O

MemoryFile

MemoryMapI/O

vs

*Resultsbasedoninternaltesting


ImportanceofFastReplication


CADirectoryReplication– DirectoryServertoDirectoryServer


DataCenterBDataCenterA

CADirectoryHasAdvancedReplicationFeaturesThatEnsureDataIsinSynchAcrossServers

AdvancedReplication

Details

§ Truemulti-masterreplication§ AnyServercanacceptanupdaterequest

§ Flexiblereplicationstrategy§ Synchronousorasynchronousreplication§ Alldatareplicatedbeforeclientupdateis

confirmed§ Canmixandmatchsynchronousand

asynchronousservers(synchronouswithinthedatacenterandasynchronoustootherdatacenters)

§ SynchronousMulti-writereplication§ AllDSAsareupdatedatthesametime§ WriteThrough(Sync)vs.WriteBehind

(Async/changelogs)

Server#1

Server#2

Server#3

Server#4

LDAPClient

Synchronous

Asynchronous

LDAP


FactorsofPerformance

§ DataPartitioning(InternaltoCADirectory)

– Applicationsviewasone‘OU’

– IncreasesUpdate/ReplicationPerformance§ MoreCPUsinvolvedmeansmorespeed!§ 3Partitionscanincreasewriteperformanceby~3times§ RealCustomerrunningnearly10,000replicatedupdates/second

ConfigurationandEnvironment


CADirectoryPerformanceMoreRecentCustomerTesting(8Servers)

9,700+Updates/Second

PerformanceUpdateNumbers– WithPartitioning

ReplicatedModification

• PartitionedData

• AllDirectoryServersupdatedin~15ms


Replication

§ HighReplicationPerformanceAllows

– AccurateLoadSharing

– Fail-overwithconfidence

– Noconfusiononwhichisthe‘Gold’copyincaseofanoutage

ApplicationsUpdatetheDirectoryMoreThanEver


PerformanceTuningandOperations



§ HardwareFactors

§ CPU– ThefastertheClockSpeed,thefastertheDirectoryServer

§ RAM– CADirectoryrequiresappropriateRAM§ DataandIndexesexistentirelyinmemory§ CADirectorycanleverageadditionalhardwareforbetterperformance§ MoreCPUsormorePhysicalServersallowDataPartitioning




§ Physicalvs.Virtual

– Wehaveseeninconsistentperformanceonvirtualservers§ RollerCoasterperformanceprofile

– Remember- TheDirectoryistheDataLayer§ Importantpieceoftheinfrastructure

– DirectoryServersmustworktogetherduringreplication§ OneslowDirectoryServerhasanimpactonothers




§ BuiltinLoad-SharingCapability

§ OptimizeIndexesforUpdatePerformance

§ Optimizethe‘TransactionLog’– Protectionintheeventofahardshutdown– Writtentodiskforauto-recovery– CanmakeDirectoryServerI/Obound– SANfortheTLgivesbothperformanceandreliability!



OperationsMadeEasy

§ On-linebackups– On-linebackupsaretakeninjustsecondsw/ointerruptionofservice– Fast,Fast– noneedforincremental(fullsnapshot)– OnDemandorScheduled– daily,hourly,wheneverneeded– Producesa‘zdb’filewhichisportableforrestoringotherDSAs

§ Justmovethezdb filetotheotherserverandrenameto‘<DSAname>.db’andstartthedirectory

§ DataFile(.db)requiresnomaintenance– Neverneedto‘tune’thedb.

VeryLowMaintenance


QuickRecap

§ SearchPerformanceisImportant§ Update/Replicationismoreimportant§ OptimizeConfigurationtomeettheHighestRequirements§ CADirectorycantakeadvantageofavailableHW§ Operationsmadeeasier(lessmovingparts)

– Increaseupdate(andremove)performance– Managememoryrequirement

§ TransactionLog– Protectionintheeventofahardshutdown– Writtentodiskforauto-recovery– CanmakeDirectoryServerI/Obound– SANfortheTLgivesbothperformanceandreliability!

PerformanceisMeasuredinManyWays


RecommendedSessions

SESSION# TITLE DATE/TIME

SCX12E FiveEasyStepsforMigratingtoCADirectory 11/15/2016at3:30pm

SCX305 BestPracticesforUpgradingSSO 11/15/2016at9:00am

SCT44T WAM&Federation(TechTalk) 11/17/2016at4:30pm


Don’tMissOurINTERACTIVESecurityDemoExperience!

SNEAKPEEK!



Wewanttohearfromyou!

§ ITCentralisaleadingtechnologyreviewsite.CAhasthemtohelpgenerateproductreviewsforourSecurityproducts.

§ ITCSstaffwillbeatmostsessions.Ifyouwouldliketoofferaproductreview,pleaseaskthemaftertheclass,orgobytheirbooth.

Note:§ Onlytakes5-7mins§ Youhavetotalcontroloverthereview§ Itcanbeanonymous,ifrequired


Questions?


Stayconnectedatcommunities.ca.com

Thankyou.


Security

FormoreinformationonSecurity,pleasevisit:http://cainc.to/EtfYyw

Technology

Tech Talk: Want to get in on the Secret? How fast is your Directory?