Directory Programming .NET

Hello,

I'm facing a performance problem with S.DS performing a search against Active Directory. The same code performing the same search (returning only 4 users) sometimes returns the result set very quickly (80ms), sometimes very slowly (up to 3200 ms).

The code is running inside a WCF web service hosted in IIS. I'm binding to an OU as shown below.

[LDAP://direstraits.rtetest.private/OU=BACKOFFICE,OU=OffreCommerciale1,OU=faxbox.com,DC=rtetest,DC=private] with user [RTETEST\Administrateur] and AuthenticationTypes [Secure, FastBind, ServerBind]

DirectorySearcher.Asynchronous is set to TRUE. Then, DirectorySearcher.FindAll() is called with the following filter set : (&(objectClass=user)). Accessing the first property of the first user usually returns very fast but sometimes very slow.

May be this is a server related issue, and I would like to know how to diagnose it.

TIA.

 

After spending some time investigation this issue, I found this MSDN document :

http://msdn.microsoft.com/en-us/library/ms806997.aspx#buildingadapps_use_multithread_properly

I'm not using impersonation in my service so binding to AD is done with the same credentials for each thread ! This could explain this behavior when several clients are accessing the service simultaneously.

Olivier.

 

If you can, try to see if you can get a network sniff of the traffic to see if there is something that is obviously timing out in the bad case.  That might give you a clue as to what is wrong.  I don't see anything obvious based on what you said though.

Here is a network capture of a long running call (SRV08 is the web service/direstraits.rtetest.private is the domain controler) taken on the domain controler :

3 2.390625  SRV08            DIRESTRAITS.rtetest.private TCP TCP: Flags=.S......, SrcPort=53356, DstPort=LDAP(389), Len=0, Seq=3857596121, Ack=0, Win=8192 (scale factor not found)
4 2.390625  DIRESTRAITS.rtetest.private SRV08            TCP TCP: Flags=.S..A..., SrcPort=LDAP(389), DstPort=53356, Len=0, Seq=179571116, Ack=3857596122, Win=16384 (scale factor not found)
7 2.390625  SRV08            DIRESTRAITS.rtetest.private TCP TCP: Flags=....A..., SrcPort=53356, DstPort=LDAP(389), Len=0, Seq=3857596122, Ack=179571117, Win=256 (scale factor not found)
9 2.390625  SRV08            DIRESTRAITS.rtetest.private LDAP LDAP: Bind Request, MessageID: 85, Version: 3
11 2.390625  DIRESTRAITS.rtetest.private SRV08            NTLMSSP NTLMSSP: 244 Bytes
13 2.390625  SRV08            DIRESTRAITS.rtetest.private LDAP LDAP: Bind Request, MessageID: 86, Version: 3
15 2.390625  DIRESTRAITS.rtetest.private SRV08            LDAP LDAP: Bind Response, MessageID: 86, Status: Success
17 2.390625  SRV08            DIRESTRAITS.rtetest.private LDAP LDAP: , MessageID: 0
18 2.390625  DIRESTRAITS.rtetest.private SRV08            LDAP LDAP: , MessageID: 0
45 2.546875  DIRESTRAITS.rtetest.private SRV08            TCP TCP: Flags=....A..., SrcPort=LDAP(389), DstPort=53356, Len=0, Seq=179573813, Ack=3857596428, Win=65229 (scale factor not found)
46 2.593750  SRV08            DIRESTRAITS.rtetest.private TCP TCP: Flags=....A..., SrcPort=53356, DstPort=LDAP(389), Len=0, Seq=3857596428, Ack=179572871, Win=256 (scale factor not found)
47 4.296875  DIRESTRAITS.rtetest.private SRV08            LDAP LDAP: , MessageID: 0
48 4.296875  SRV08            DIRESTRAITS.rtetest.private LDAP LDAP: , MessageID: 0
49 4.296875  SRV08            DIRESTRAITS.rtetest.private TCP TCP: Flags=F...A..., SrcPort=53356, DstPort=LDAP(389), Len=0, Seq=3857596459, Ack=179573813, Win=252 (scale factor not found)
50 4.296875  DIRESTRAITS.rtetest.private SRV08            TCP TCP: Flags=....A..., SrcPort=LDAP(389), DstPort=53356, Len=0, Seq=179573813, Ack=3857596460, Win=65198 (scale factor not found)
51 4.296875  DIRESTRAITS.rtetest.private SRV08            TCP TCP: Flags=F...A..., SrcPort=LDAP(389), DstPort=53356, Len=0, Seq=179573813, Ack=3857596460, Win=65198 (scale factor not found)
52 4.296875  SRV08            DIRESTRAITS.rtetest.private TCP TCP: Flags=....A..., SrcPort=53356, DstPort=LDAP(389), Len=0, Seq=3857596460, Ack=179573814, Win=252 (scale factor not found)

I may be wrong but it seems that everything is OK and the query itself takes time to be processed.

 

It could be that it is just the DC that is responding slowly.  It might be a good idea to enable expensive query logging and see if you can find out whether the server is processing some other queries that might be particularly expensive.

If the server is just slow sometimes, there isn't much the client can do about that I suppose.

FYI... the Asynchronous property on the DirectorySearcher is useless.  While it does set an option in ADSI, it actually has no effect because we are blocking on the call (making it synchronous again).

Don't bother setting it.  Use SDS.P if you really want async.

---

Ryan Dunn
Extemporaneous Mumblings
The .NET Developer's Guide to Directory Services Programming