We might want to look into what can be gained by switching from using
the Mozilla LDAP JDK in Dogtag to the UnboundID Java LDAP SDK. The
UnboundID SDK is actively maintained, and has support for quite a few
things that the Mozilla LDAP JDK is lacking. I also found this blog
posting by Neil Wilson (the main developer of the UnboundID SDK),
which shows performance comparisons of many Java LDAP SDKs, including
Mozilla's:
http://www.dirmgr.com/blog/2011/5/31/comparing-java-ldap-sdk-performance....
I'd recommend looking at the above blog post to see the results, but
the UnboundID SDK is significantly faster than the Mozilla LDAP JDK in
all tests.
The UnboundID Java LDAP SDK would need to be packaged for Fedora, but
that would be a pretty easy undertaking. It is available under GPLv2
and LGPLv2.1. I do not know how big an effort porting would be, but
it may very well be worthwhile to switch. I've opened the following
ticket in trac to look into this some more:
https://fedorahosted.org/pki/ticket/102
-NGK
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
From the very brief look at UnboundID, its crypto implementation may
not be flexible enough.
Andrew