[cvsnt] Re: Slow authentication with cvsnt and sspi

[Tony Hoyle]

Krogsgaard, Lotte wrote:
> Domain users are supposedly being authenticated through the CVS group + the
> appropriate directory settings, however, it has become increasingly slow -
> not sure whether this may have been caused by an update of the CVS product
> or some other event. I have traced the time to be spent after 'checking
> local access token for groups' and I am wondering exactly what is happening
> during 'add_valid_group'. Actually authentication can be performed
> successfully through  the CVSUsers group, which the (domain) user is a
> member of.  As can be seen from the below trace 'Domain Users' are being
> added multiple times, and this takes a lot of time. Does anyone have any
> ideas as to what can be done to improve performance?

Adding groups multiple times is a consequence of nested group 
memberships... it looks like your domain admin has added domain users to 
lots of different groups (this is harmless though).

The group enumration shouldn't take more than a fraction of a second 
normally.  It sounds like the connection to your domain controller is 
slow for some reason... this will be slowing down any application that 
needs to authenticate (plus NTFS access etc.) so it's well worth looking 
into.

Tony