User Authorization Cache (AZ) in policy server

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

How User Authorization Cache works on the Policy server.

Environment

Policy Server : 12.8.x

Resolution

The User AZ cache stores information about policies applied to a given user. When a policy is bound to a user directory object such as a group it is necessary to determine whether a particular user belongs to the group (i.e. it is necessary to search the directory to get the user's membership list). The User Authorization Cache prevents this round trip to the directory. Note that if a policy is bound to a user name (or DN, OU, and O); the Authorization Cache is ineffective because in this case there is no need to search the directory in the first place.

Type: Key/Value map with timestamp for each entry. When cache limit is reached, 25% of random entries are removed. During a successful lookup the timestamp is checked and the entry is invalidated if it has expired.

Key: Directory+UserDN+PolicyUserFilter+PolicyResolution+PolicyFlags

Value: True (if a policy applies to the user), False otherwise

Entry added: Every time user-policy relationship is found.

Entry removed:

• When the cache limit is reached 25% random entries are removed.
• When the entry has expired. (Default 60 minutes)
• When the "FlushAll" or the "FlushUsers" commands are processed all entries are removed.

Registry Key Locations:

Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Ds\DsCacheParms

Linux
Locate sm.registry file.

(NOTE: These keys provide information about User authorization cache parameters that cannot all be set through smconsole. Only the User Authorization cache size can be set in the SMConsole in "Settings > Performance > User Az Cache Size (MB)".)

DsInfoEnabled specifies whether User Authorization cache is enabled or disabled. DWORD=1 implies that User Authorization cache is enabled.

Default value: 0

Range: 0 - 3

0: Cache Disabled.

1: Cache All.

2: Cache entries if given policy is applicable irrespective of the authorization result. Policy applicable doesn't mean authorization is successful. Authorization can be failed due to IP restriction or time restriction or user namespace restriction etc.

3: Cache entries only when given policy is not applicable for user.

DsInfoTimeoutSeconds specifies in number of seconds the lifetime of the above mentioned cache entry.
Default value: 3600
Range: 0 - *

DsInfoMaxSizeMB specifies the maximum size of cache entries that are allowed in the user authentication cache.
Default value: 10
Range: 0 - *

UserPolicyCacheMaxSize sets the number of entries for the user policy cache (if present). If this entry is not present, or is set to 0, then this cache will not be active.
Default value: 1000
Range: 0 - *

Additional Information

In siteminder 6.x and R12 you specify the User Authorization cache size in MB. Each entry is estimated to be 64 bytes, therefore the formula simply needs to convert the number of entries to MBs as follows: Number of MB = (ExpectedNumberOfUsers * NumberOfPolicies * 64) / 1048576