Slow login to JSS and Self Service

[drit008]

I have a JSS with ~ 1000 clients, so quite small. It uses AD authentication.

I have noticed that some users can login quickly, while others can take over a minute to login. Does this sound like a mapping issue?

[dwandro92]

Sounds to me like it's a problem with your LDAP configuration on the JSS. In the JSS, navigate to Settings > System Settings > LDAP Servers and make 2 clones of your existing LDAP configuration. Open one of the new configurations that is created and try these tips:

Connections tab

• Use Wildcards When Searching: Unchecked

Mappings tab > User Mappings

• Object Class(es): organizationalPerson, user
• Search base: Verify an OU is being used (e.g. OU=Users,DC=MY,DC=DOMAIN,DC=com) rather than the domain search path (e.g. DC=MY,DC=DOMAIN,DC=COM) IF AT ALL POSSIBLE

Mappings tab > User Group Mappings

• Object Class(es): group
• Search base: Verify an OU is being used (e.g. OU=Groups,DC=MY,DC=DOMAIN,DC=com) rather than the domain search path (e.g. DC=MY,DC=DOMAIN,DC=COM) IF AT ALL POSSIBLE

Mappings tab > User Group Membership Mappings

• Membership Location: User Object
• Group Membership Mapping: memberOf

Once all of these settings have been changed/verified, click the Save button, then click Test and test all of your LDAP mappings using some random users and groups. If any of the above items were changed, you should now be seeing increased search and login speeds. If tests are successful, update the configuration of your existing LDAP configuration and delete the one you were testing with. If users begin to experience more issues, use your second clone to change your configuration back to it's original values and delete your second clone.

I hope this helps, good luck!

[drit008]

Hi, yes we do look inside user objects for groups. Before when we were searching group objects for users it took twice as long.

Our AD contains ~300,000 groups, and 60,000+ users. Users are contained in a single OU, Groups SHOULD be in a single OU, but in reality can span the whole AD.

Our AD is a conglomeration of multiple namespaces. For instance, a Science faculty could have groupname.sit groupname.che groupname.psy etc. Using openldap , I generate specific filters to handle this number of objects.

HOWEVER! I haven't tried turning off wildcards - will do that, and see how I go. Thanks.