I'd be interested in impact of last_success with multiple principals. I expect that you should get less performance impact from last_success against an ldap database if you use multiple principals. I'm not sure db2 has fine enough locking.