Users with large numbers of group memberships experience slow login times using TLS about adauth HOT 2 OPEN

If I bypass the allowed_to_login method which checks all of the group and ous then the delay is gone. I would think that it would be better to check to see if the user actually needs the application to verify if it is needed to traverse the users group and uo assignments prior to doing so.

The original code:

def self.allowed_to_login(user)
  (allowed_from_arrays(@config.allowed_groups, @config.denied_groups, user.cn_groups_nested) && allowed_from_arrays(@config.allowed_ous, @config.denied_ous, user.dn_ous))
end

Here would be an alternative:

def self.allowed_to_login(user)
  #Only inspect groups and organizations if required
  (((@config.allowed_groups.blank? && @config.denied_groups.blank?) || allowed_from_arrays(@config.allowed_groups, @config.denied_groups, user.cn_groups_nested)) && ((@config.allowed_ous.blank? && @config.denied_ous.blank?) || allowed_from_arrays(@config.allowed_ous, @config.denied_ous, user.dn_ous)))
end

On a side note allowed_ous and denied_ous are not mentioned in the default config. Cn_groups_nested an dn_ous need some love to help with this issue for those users that do have to verify group and ou membership.

from adauth.

Will look into tidying this up ASAP

from adauth.