ProGet 2023 - IIS App pool stopping

rick.kramer_9238

@atripp Do you have any thoughts on the changing the Start Mode and the idle timeout on the app pool? Or Preload Enabled on the Site?

atripp

Hi @rick-kramer_9238 , you could certainly try to enable those and see if they help or make a change.

rick.kramer_9238

@atripp After doing more testing, I do not think this has anything to do with IIS. I think the login process is what is spinning for 3-4 minutes on initial testing in the morning. We have Windows Integrated Auth enabled wich is what we had been using before upgrade. It looks like Username/Password is also enabled now, not sure if that was enabled before the upgrade. I would be interested in any thoughts you might have on this. thanks

atripp

Hi @rick-kramer_9238 ,

We have seen cases where LDAP/AD is painfully slow; one common reason is that "recursive group search" is enabled.

But before digging into that, I would just temporary disable Windows Auth (do this in IIS) and disable LDAP/AD, so that you're only loggin in with a built-in username/password. If it's still really slow, then you know it's unrelated.

Best,
Alana

rick.kramer_9238

@atripp If we switch to using integrated web server I would probably upgrade from 2023.30 to 24.0.1. If we would happen to need to rollback, would a database restore be needed-- are there database changes moving between these version? Thanks!

stevedennis

Hi @rick-kramer_9238 ,

I wouldn't recommend upgrading to ProGet 2024 solely for that reason, as it's a major release and if there were issues, it'd be easier to isolate Integrated Web Server vs Regression.

Here are the upgrade notes:
https://docs.inedo.com/docs/proget-upgrade-2024

That said, if you need to rollback to ProGet 2023, you can do so without restoring the database by simply using the Inedo Hub. While there are database schema changes, they are all backwards-compatible with ProGet 2023, which means you can safely rollback your ProGet installation if there's a showstopper bug, and then upgrade later.

However, you should backup your database as an extra precaution anyway.

Thank you,
Steve

rick.kramer_9238

@atripp After re-installed with the IWS, we want to set up HTTPS and bind the the existing cert for the DNS entry we use for our ProGet instance. Is it necessary to do all the steps on https://docs.inedo.com/docs/installation-windows-https-support, or can we just register the certificate underneat "HTTPS Binding to a Hostname"

atripp

Hi @rick-kramer_9238,

In all cases, you'll need to configure ProGet to listen to a certain URL; this basically involves editing the ProGet configuration file, which the web page will do for you (or you can edit yourself).

If you're going to do port sharing (i.e. have multiple applications on the server listen/respond
on port 443 for example), the you also need register the URL and certificate with Windows using the netssh commands.

If you're not doing port sharing (i.e. ProGet is only application listening on 443) then no need to use netsh.

Hope that helps,
Alana

rick.kramer_9238

@atripp Thanks, we got the cert added and https working fine, but after moving away from IIS and running ProGet self-hosted, if anyting the logging time is worse. Everytime I bring up the UI it re-auths me and spins for minutes before opening. There are no messages in the Diagnostic Center. Is there any place I can turn on additional logging to help diagnose this?

stevedennis

Hi @rick-kramer_9238,

The issue sounds like it's related to LDAP configuration (i.e. slow queries to your LDAP/AD server), but it's hard to say. This wouldn't behave any differently in IIS for IWS.

The first thing I would try is disabling LDAP / AD. And Windows Integrated Authentication (if you have it enabled). If the server is still slow, then I would try http:// instead of https://

Once you've identified where the slowness is coming from, we can address it. The most common issue with LDAP is recursive/nested group searches - especially when there are like thousands of groups and everyone's a member of something.

I would "play" with your LDAP settings and try to isolate why it's so slow.

Thanks,
Steve

rick.kramer_9238

@stevedennis I swtiched from "V3: Active Directory (LDAP)" to "V4: Active Directory/LDAP (Preview)" and all is good now. Logon went from two/three minutes down to one second.