Change to way Identity Manager 3.5 plug-ins search for Driver sets.

After upgrading to IDM 3.5 in my 8.7.3 tree. The plug-ins timeout anytime I try and search for a driver set. My tree has over 100,000 users. I fixed the issue by adding a value index on Object Class. Has something changed?

Identity Manager 3.5 plug-ins was changed to search for driver sets using a filtered search on the "Object Class" attribute instead of walking the tree. This change fixed of the problem of the plug-ins taking several minutes to find driver sets in a large tree.

The reason for the search to be slow, regardless of whether you specify a base container close to the driver or not, is that the search behavior in eDirectory 8.7.3 applies first the search filter to the result set and then processes the base container. As the amount of objects in the database increases, the search simply takes longer. By adding the index there is no need to visit each entry to retrieve the right information.

The subtree search behavior has changed between 8.7.3 and 8.8. With 8.8 the database can make subtree searches in a more efficient way by using the "Ancestors ID", a reference in the underlying database to the position of objects in the tree. If you run the plug-in against an 8.8 server, the plug-in will be efficient, regardless of whether the index is there or not, because of the appropriate use of the base container. However, if you still have 8.7.3 in your tree and the plug-in hits one of those servers, you will still experience the same problem.