AD Authentication Slowness

[Kevin_Danel]

Hello,

My organization recently implemented AD Authentication in our OnBase system and although it is working, my users think that the authentication speed is too slow. I know that this could probably primarily be a network speed issue; however, I am not sure how to go about identifying where the slowness is coming from. Has anyone had a similar situation and has any advice? We mostly use the OnBase Thick Client but the slowness is also seen using the Web Client. Authentication time usually ranges between 15 seconds and 30 seconds.

Thank you,

Kevin Danel
OnBase Administrator
the Chickasaw Nation
Information Technology

[AdamShaneHyland · Accepted solution]

Hi Kevin!

Thanks for the post.

I'm sorry to hear about the network authentication slowness issue you are experiencing.  If you are noticing the issues in both the OnBase Thick Client and the Web Client, the easiest way to troubleshoot is to start by enabling the verbose switch on the OnBase Thick Client shortcut.  Simply add the -V switch.  This will write a verbose log to the users temporary directory (Start | Run | %temp%).  Looking through the verbose logs, you should see timestamps.  Scroll through the log file until you see major gaps in time.  This might help to identify why there are lags querying back to Active Directory.

Additionally, you could enable the LDAP profile within the Application Servers web.config.  This can be done manually by setting the enableMailSlot from false to true and then attempting to login with the Diagnostics Console running.  You might have to enable the LDAP/NT tab to view the messages.  Once enabled you will see the messages generated by a user attempting to authenticate into OnBase.  As well, you should be able to find gaps in time where slowness is being experienced.

If you are not familiar/comfortable troubleshooting using Verbose or other tools such as Diagnostics Console, I would recommend working with your first line of support.

Take care.

[AdamShaneHyland · Accepted solution]

Hi Kevin!

Thanks for the post.

I'm sorry to hear about the network authentication slowness issue you are experiencing.  If you are noticing the issues in both the OnBase Thick Client and the Web Client, the easiest way to troubleshoot is to start by enabling the verbose switch on the OnBase Thick Client shortcut.  Simply add the -V switch.  This will write a verbose log to the users temporary directory (Start | Run | %temp%).  Looking through the verbose logs, you should see timestamps.  Scroll through the log file until you see major gaps in time.  This might help to identify why there are lags querying back to Active Directory.

Additionally, you could enable the LDAP profile within the Application Servers web.config.  This can be done manually by setting the enableMailSlot from false to true and then attempting to login with the Diagnostics Console running.  You might have to enable the LDAP/NT tab to view the messages.  Once enabled you will see the messages generated by a user attempting to authenticate into OnBase.  As well, you should be able to find gaps in time where slowness is being experienced.

If you are not familiar/comfortable troubleshooting using Verbose or other tools such as Diagnostics Console, I would recommend working with your first line of support.

Take care.

[Kevin_Danel]

Thank you for your advice, Adam. I see thru the verbose logs that it is having to go thru every individual OnBase/AD user group and see if my account is in it or not. We have about 500 groups that it has to go through. That is the part that seems to be taking the longest.

We are set to use the Network Security option named "Active Directory." The username mapping attribute we have is sAMAccountName. We have it set to Synchronize User
Attributes on Auto-Logon. Within the Active Directory settings, we have "Search User's Login Domain Only" checked and also "No Serverless Binds" checked.

[AdamShaneHyland]

Thanks for the update. The next question, which authentication method are you using for Active Directory? Depending on the method we might have some options to make it faster.

[Kevin_Danel]

We are set to use the Network Security option named "Active Directory." The username mapping attribute we have is sAMAccountName. We have it set to Synchronize User Attributes on Auto-Logon. Within the Active Directory settings, we have "Search User's Login Domain Only" checked and also "No Serverless Binds" checked.