asked on

Active Directory: User.IsInRole() taking several seconds for useres in many groups.

In my ASP .NET Application I check to see if the user is in the Active Directory group, "AppsDev." We have found that for users in many Active Directory Groups it takes several more seconds to load the web page when calling User.IsInRole("XXX\AppsDev"). Is there any explanation for this? It makes no sense why it would take longer if you are specifying the group to check.

brad

Jesse Houwing

If you have many domain controllers in the Forest, or your domaincontroller is far away (in ping time) it takes a while to transfer the whole list back to the webserver. Especially if trust relations are in place. It will take just as long as a user with fewer groups if they're still well spread across the forest.

For more info have a look at the ebook at: http://www.winsecguide.net/

Jesse Houwing

I think it should be cached though....

bradtm

ASKER

The Active Directory server is on the Intranet. We've tested applications that call User.IsInRole() and it takes a significant amount longer when a user is in a lot of groups. I'm in 15, but someone who is in 100 takes 7x longer.

Jesse Houwing

Are you using multiple trees in the domain forest? Or are all groups under th esame DC?

SOLUTION

laotzi2000

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

ASKER CERTIFIED SOLUTION

Jesse Houwing

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer