IsInRole performance issue

From: Joseph E Shook (JoeShook@DeploymentCentric.com)
Date: 03/17/03 

From: "Joseph E Shook" <JoeShook@DeploymentCentric.com>
Date: Sun, 16 Mar 2003 22:07:00 -0800

I have found an issue with IsInRole().

The following is a piece of test code:

using System;
using System.Security.Principal;
using System.Threading;

class Class1
{
    [STAThread]
    static void Main(string[] args)
    {

AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal)
;
        DateTime startTime = DateTime.Now;

Console.WriteLine(Thread.CurrentPrincipal.IsInRole("Everyone").ToString());
        DateTime endTime = DateTime.Now;
        Console.WriteLine("Elapsed time: " + ((TimeSpan)(endTime.TimeOfDay -
startTime.TimeOfDay)).ToString());
        Console.ReadLine();
    }
}

Usage:

-Create a domain account.
-Add that domain account to a large number of groups. I tested with 300
groups the first time.
-Install NetMon and monitor network traffic between your client machine and
your domain controller. In my test I setup netmon on the domain controller.
-Make sure that you log in with new account and that your token now contains
the 300 groups. Use WhoAmI from one of the OS resource kits if you want to
be sure that your token contains all of the groups.
-Run the sample code and watch the number of frames that are sent to the
domain controller.

More Info:

I found that when the sample account was a member of 125 groups in my test
only 6 frames would be sent out. But when I increased the group membership
to 126 then I observed 2030 frames being sent from the client to the domain
controller.

This is almost unoticable when the client and domain controller are in the
same subnet. But when you put some distance between the two entities the
performance is magnified. I have a web server that experienced this issue
when the Web server was in another building than the domain machines.

You might say who would ever have 125 groups in their token? Well with the
increase use of Active Directory and the abilit to be placed in Universal
Groups, Global Groups, and Domain Local Groups, and more and more
applications relying on integrated security, ones group memebership could
grow. Atually I have an application that we were contemplating a membership
of close to 100 groups depending on the user.

What worries me more than whether I implement an application with a large
number of group membership is that fact that some other application could
put a user account in multiple groups. That will effect all of the inocent
applications that only relied on 2 or three roles.

Anyways with the help of Keith Brown I implemented a IsInRole() substitute
for the frameworks IsInRole(). My implementation uses LsaLookUpNames and
CheckTokenMembership APIs. I think that the framework is just implmented
with an older API.

I also checked that the 300 group membershp was not a problem by placing a
text.htm file on my web server and securing it with an ACE allowing only the
test account access to it. Of course it has no additional network traffic
to determine access because it isn't useing the same API as the frameworks
IsInRole().

I also implemented this test in asp.net and deployed it on Win2003 RC2 which
is using the 1.1 framework. I have not compiled the console app above under
the 1.1 framework but I believe the deployment to RC2 would suffice.

Relevant Pages

  • IsInRole performance issue
    ... -Add that domain account to a large number of groups. ... In my test I setup netmon on the domain controller. ... number of group membership is that fact that some other application could ... I think that the framework is just implmented ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Security Breach in AD! Help!
    ... > about 5 minutes the user was removed from the built in admin group. ... > changed the default domain policy, the default domain controller policy, ... >> auditing of account logon for success and failure and account management ... >> success and failure in Domain Controller Security Policy. ...
    (microsoft.public.win2000.security)
  • Re: disable users while user is logged into the domain
    ... That article i read more and more before, but it does not state anything about "disabling" an account. ... Assigning an account lockout, which a domain controller performs to ... Changing the password on a domain controller computer account. ... The PDC emulator receives urgent replication of account lockouts. ...
    (microsoft.public.windows.server.active_directory)
  • Re: disable users while user is logged into the domain
    ... Please check the following link for more information concerning urgent replication. ... How the Active Directory Replication Model Works: ... Assigning an account lockout, which a domain controller performs to prohibit a user from logging on after a certain number of failed attempts. ...
    (microsoft.public.windows.server.active_directory)
  • Re: More than one Administrator Account and Reinstalling OS on a D
    ... Some one has created a regular user account and may added that one to ... There is only one built-in administrator peer domain. ... FSMO roles are actually supposed to be transferred automatically during ... When you remove an existing Domain Controller within Active Directory, ...
    (microsoft.public.win2000.active_directory)