7

For some reason GetAuthorizationGroups() seems to be taking around 20 seconds to return the groups. I am using this code:

UserPrincipal user;

// This takes 20 seconds
user.GetAuthorizationGroups().OfType<GroupPrincipal>().ToList();

Anyone got any ideas or is it simply a slow AD domain? (It doesn't take that long to view the groups in Outlook for instance)

Cheetah
  • 13,785
  • 31
  • 106
  • 190
  • It probably has to do with how you initialize the Context. – Sean Hall Jun 07 '14 at 19:22
  • @SeanHall - how so? I've put a stopwatch on and the quoted line in the OP takes 20 seconds to run. – Cheetah Jun 07 '14 at 20:06
  • It's lazy when binding. Do you do anything with the `UserPrincipal` before this call? – Sean Hall Jun 07 '14 at 23:54
  • @SeanHall - I thought it was. I don't do anything before I make the call. I am assuming this call is doing something special, maybe something I don't actually need. All I wish to do is get the groups the user is a member of. – Cheetah Jun 08 '14 at 11:01
  • @WiktorZychla its a multinational company so pretty big, but viewing the groups in outlook is fairly quick. – Cheetah Jun 09 '14 at 10:10
  • 1
    @Cheetah: we had similar issue and reading the `tokenGroups` out of the bare `DirectoryEntry` was breezing fast in contrary to the account management api. – Wiktor Zychla Jun 09 '14 at 15:55
  • @WiktorZychla - thank you. It is what Sean suggested below. Much better. – Cheetah Jun 09 '14 at 16:20
  • @Cheetah: haven't seen his comment and this only means that this is a right approach. We have reduced the time of reading groups from 3 seconds to 50 miliseconds this way. – Wiktor Zychla Jun 09 '14 at 16:23
  • @WiktorZychla...sorry I feel that may have come out wrong. All I was saying is that Sean Hall mentioned it in one of the comments on his post below. The "Much better." bit at the end was because it reduced from 20seconds down to milliseconds when I implemented it. Thanks again! – Cheetah Jun 09 '14 at 18:38

2 Answers2

3

Try doing something with the UserPrincipal object before making this call to try to remove the initialization time. If that new operation also takes a long time, then check out my other answers to similar questions.

Community
  • 1
  • 1
Sean Hall
  • 7,629
  • 2
  • 29
  • 44
  • 1
    I printed out `user.EmployeeId` and it look milliseconds. – Cheetah Jun 09 '14 at 10:13
  • 2
    @Cheetah One last thing I can think of is to check how long it takes the DC to return the groups using the `tokenGroups` attribute, as explained in [this answer](http://stackoverflow.com/a/4460658/628981). Maybe I have it backwards and the `AccountManagement` namespace is being eager instead of lazy. – Sean Hall Jun 09 '14 at 13:12
1

Credit to this post https://milestone.topics.it/2012/12/userprincipalgetauthorizationgroupsoh-my.html which pointed out this small method

RefreshCache( new string[] { "tokenGroups" } );

which you have to run on the underlying DirectoryEntry. Doing so before calling GetAuthorizationGroups() massively improves performance. So if you try the below code -

userPrincipal user; // Initialise
DE = (DirectoryEntry)user.GetUnderlyingObject();
DE.RefreshCache(new string[] { "tokenGroups" });
user.GetAuthorizationGroups()
David Lindon
  • 305
  • 2
  • 8