Hi,
We are experiencing periodic latency issues after migrating from V4 to V5 of the Active Directory user directory implementation.
Summary of the issue:
We observe intermittent delays of ~15 seconds or more
The delays appear to occur when the cache expires (Web.PrivilegeCacheExpiration)
Due to this, we have reverted to V4: Active Directory, which does not exhibit the same behavior
Environment characteristics:
Large Active Directory environment
Users have significant group memberships (including nested groups)
Behavior differences:
V4 works reliably, especially with recursive lookups disabled
V5 does not expose an option to disable recursive group resolution
The issue only appears in V5
Testing performed:
We attempted to reproduce the delay using PowerShell
Measure-Command {
Get-ADUser <myusername>
}
Measure-Command {
Get-ADUser <myusername> -Properties memberOf
}
Measure-Command {
Get-ADPrincipalGroupMembership <myusername>
}
All of these return quickly in our environment.
However, we understand these cmdlets may not reflect the same LDAP query patterns used internally by V5 (e.g., DirectorySearcher, recursive group enumeration, or per-group lookups).
Questions:
Does V5 perform recursive group resolution via individual LDAP queries rather than using tokenGroups or equivalent server-side expansion?
Is there a way to disable or limit recursive group resolution in V5 (similar to V4)?
Does V5 perform additional lookups per group (e.g., resolving each memberOf DN individually)?
Given that the delays correlate with cache expiration, it seems likely that group resolution or permission evaluation is triggering a large number of LDAP queries.
Any guidance or recommendations would be appreciated.