We might want to look into what can be gained by switching from using the Mozilla LDAP JDK in Dogtag to the UnboundID Java LDAP SDK. The UnboundID SDK is actively maintained, and has support for quite a few things that the Mozilla LDAP JDK is lacking. I also found this blog posting by Neil Wilson (the main developer of the UnboundID SDK), which shows performance comparisons of many Java LDAP SDKs, including Mozilla's: http://www.dirmgr.com/blog/2011/5/31/comparing-java-ldap-sdk-performance.htm... I'd recommend looking at the above blog post to see the results, but the UnboundID SDK is significantly faster than the Mozilla LDAP JDK in all tests. The UnboundID Java LDAP SDK would need to be packaged for Fedora, but that would be a pretty easy undertaking. It is available under GPLv2 and LGPLv2.1. I do not know how big an effort porting would be, but it may very well be worthwhile to switch. I've opened the following ticket in trac to look into this some more: https://fedorahosted.org/pki/ticket/102 -NGK