UserPrincipal.GetAuthorizationGroups() is slow

Question

For some reason GetAuthorizationGroups() seems to be taking around 20 seconds to return the groups. I am using this code:

UserPrincipal user;

// This takes 20 seconds
user.GetAuthorizationGroups().OfType<GroupPrincipal>().ToList();

Anyone got any ideas or is it simply a slow AD domain? (It doesn't take that long to view the groups in Outlook for instance)

Cariecaries

It probably has to do with how you initialize the Context. – Piercy

@SeanHall - how so? I've put a stopwatch on and the quoted line in the OP takes 20 seconds to run. – Cariecaries

It's lazy when binding. Do you do anything with the UserPrincipal before this call? – Piercy

@SeanHall - I thought it was. I don't do anything before I make the call. I am assuming this call is doing something special, maybe something I don't actually need. All I wish to do is get the groups the user is a member of. – Cariecaries

@WiktorZychla its a multinational company so pretty big, but viewing the groups in outlook is fairly quick. – Cariecaries

@Cheetah: we had similar issue and reading the tokenGroups out of the bare DirectoryEntry was breezing fast in contrary to the account management api. – Bushman

@WiktorZychla - thank you. It is what Sean suggested below. Much better. – Cariecaries

@Cheetah: haven't seen his comment and this only means that this is a right approach. We have reduced the time of reading groups from 3 seconds to 50 miliseconds this way. – Bushman

@WiktorZychla...sorry I feel that may have come out wrong. All I was saying is that Sean Hall mentioned it in one of the comments on his post below. The "Much better." bit at the end was because it reduced from 20seconds down to milliseconds when I implemented it. Thanks again! – Cariecaries

Answer 1

Try doing something with the UserPrincipal object before making this call to try to remove the initialization time. If that new operation also takes a long time, then check out my other answers to similar questions.

Piercy

I printed out user.EmployeeId and it look milliseconds. – Cariecaries

@Cariecaries One last thing I can think of is to check how long it takes the DC to return the groups using the tokenGroups attribute, as explained in this answer. Maybe I have it backwards and the AccountManagement namespace is being eager instead of lazy. – Piercy

Answer 2

Credit to this post https://milestone.topics.it/2012/12/userprincipalgetauthorizationgroupsoh-my.html which pointed out this small method

RefreshCache( new string[] { "tokenGroups" } );

which you have to run on the underlying DirectoryEntry. Doing so before calling GetAuthorizationGroups() massively improves performance. So if you try the below code -

userPrincipal user; // Initialise
DE = (DirectoryEntry)user.GetUnderlyingObject();
DE.RefreshCache(new string[] { "tokenGroups" });
user.GetAuthorizationGroups()

Bereave

Doesn't work for me...even slower. – Raleighraley